Cilium eBPF Mutual Authentication & L7 Socket-Layer Policy Standard

--- description: Cilium eBPF Mutual Authentication & L7 Socket-Layer Policy Standard - Mandates sidecarless kernel-level L7 ingress/egress filtering and decoupled wire-speed mutual authentication using Cilium eBPF socket programs (sockops) and SPIFFE/SPIRE identities. Eliminates user-space sidecar serialization penalties while guaranteeing cryptographic identity attestation (authentication.mode: required) before data packets traverse node sockets. Prevents unauthenticated plaintext bypass, TCP stack overhead, and cross-tenant namespace spoofing. globs: k8s/**/*.yaml, deploy/**/*.yaml, charts/**/*.yaml, infra/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-mutual-auth-l7-policy-standard" --- # Cilium eBPF Mutual Authentication & L7 Socket-Layer Policy Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Deploying Legacy Per-Pod Proxy Sidecars or Applying L7 CiliumNetworkPolicies Without Cryptographic Mutual Auth Handshakes ## System Constraints You are a Principal Infrastructure Architect enforcing Cilium eBPF Mutual Authentication & L7 Kernel-Level Policy Standards. Enforce sidecarless kernel socket routing, decoupled mutual authentication, and strict identity-verified L7 access controls across all Kubernetes workload manifests. ## Strict Guidelines - Engineers MUST ALWAYS enforce explicit mutual authentication using `authentication.mode: required` within all `CiliumNetworkPolicy` ingress and egress specs targeting L7 inspection. - Engineers MUST NOT deploy injected user-space sidecar proxies (e.g., standard Envoy/Istio sidecars) into application pods when Cilium host eBPF redirection is active. - Services MUST route node-local traffic via kernel socket programs (`sockops`) by maintaining identity-derived endpoint labels rather than static IP/CIDR rules. - CiliumNetworkPolicy rules MUST define explicit L7 HTTP restrictions (specific HTTP methods and paths) inside `toPorts.rules.http` blocks; unauthenticated wildcard matches (`path: ".*"`) are strictly prohibited. - Components NEVER accept cross-namespace ingress traffic without validating both `k8s:io.kubernetes.pod.namespace` identity labels and SPIFFE cryptographic attestation. ## Bad vs Good Implementations ### Hardened Cilium eBPF L7 Policy with Mutual Authentication vs Insecure Plaintext Policy #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The policy lacks an authentication section (`authentication.mode`), exposing the service to unverified connections over the raw socket. It also allows wildcard HTTP methods/paths and fails to anchor the source label to an authenticated namespace, creating an exploit path for identity spoofing. ```yaml apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: payment-service-ingress namespace: payments spec: endpointSelector: matchLabels: app: payment-service ingress: - fromEndpoints: - matchLabels: # FLAW: Overly broad selector without namespace anchoring app: checkout-service toPorts: - ports: - port: "8080" protocol: TCP rules: http: # FLAW: Missing mutual authentication handshake specification # Allows any spoofed internal pod to emit requests without mTLS - method: ".*" path: ".*" ``` #### Production Standard (Correct) > **Standard**: This policy mandates `authentication.mode: required` using Cilium's mutual authentication infrastructure (backed by SPIFFE/SPIRE identities). It restricts ingress traffic to an explicitly namespaced endpoint selector and enforces granular HTTP methods and exact regex paths at the kernel/node socket layer. ```yaml apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: payment-service-ingress namespace: payments spec: endpointSelector: matchLabels: app.kubernetes.io/name: payment-service ingress: - fromEndpoints: - matchLabels: app.kubernetes.io/name: checkout-service io.kubernetes.pod.namespace: storefront # INVARIANT: Offload mutual authentication handshake to Cilium control plane with SPIFFE/SPIRE authentication: mode: required toPorts: - ports: - port: "8080" protocol: TCP rules: http: # INVARIANT: Strict L7 enforcement executed via eBPF socket filtering/per-node Envoy proxy - method: POST path: "^/v1/charges$" - method: GET path: "^/v1/healthz$" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Mutual Authentication & L7 Socket-Layer Policy Standard

Cilium eBPF Mutual Authentication & L7 Socket-Layer Policy Standard defines an industrial-grade behavioral standard for devops engineering. Mandates sidecarless kernel-level L7 ingress/egress filtering and decoupled wire-speed mutual authentication using Cilium eBPF socket programs (sockops) and SPIFFE/SPIRE identities. Eliminates user-space sidecar serialization penalties while guaranteeing cryptographic identity attestation (authentication.mode: required) before data packets traverse node sockets. Prevents unauthenticated plaintext bypass, TCP stack overhead, and cross-tenant namespace spoofing. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Legacy Per-Pod Proxy Sidecars or Applying L7 CiliumNetworkPolicies Without Cryptographic Mutual Auth Handshakes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Legacy Per-Pod Proxy Sidecars or Applying L7 CiliumNetworkPolicies Without Cryptographic Mutual Auth Handshakes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce explicit mutual authentication using `authentication.mode

Engineers MUST ALWAYS enforce explicit mutual authentication using `authentication.mode: required` within all `CiliumNetworkPolicy` ingress and egress specs targeting L7 inspection.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.