AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
devopscritical PriorityID: cilium-ebpf-sidecarless-mtls-spire-standard

Cilium eBPF Sidecarless mTLS with SPIFFE/SPIRE Workload Attestation Guardrail

Enforces zero-trust cryptographic workload identity and kernel-level mutual TLS via Cilium eBPF and SPIFFE/SPIRE without user-space sidecar proxies. Mandates strict X509-SVID attestation at the host kernel layer to eliminate sidecar latency, memory amplification, and bypass vulnerabilities. Prohibits unauthenticated pod-to-pod network policies and unvalidated fallback transport paths.

Prohibited Anti-Pattern: Injecting latency-heavy sidecars or omitting SPIRE authentication blocks in Cilium Network Policies

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Cilium eBPF Sidecarless mTLS with SPIFFE/SPIRE Workload Attestation Guardrail - Enforces zero-trust cryptographic workload identity and kernel-level mutual TLS via Cilium eBPF and SPIFFE/SPIRE without user-space sidecar proxies. Mandates strict X509-SVID attestation at the host kernel layer to eliminate sidecar latency, memory amplification, and bypass vulnerabilities. Prohibits unauthenticated pod-to-pod network policies and unvalidated fallback transport paths.
globs: deploy/**/*.yaml, k8s/**/*.yaml, helm/**/*.yaml, policies/**/*.yaml, infra/**/*.yaml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cilium-ebpf-sidecarless-mtls-spire-standard"
---

# Cilium eBPF Sidecarless mTLS with SPIFFE/SPIRE Workload Attestation Guardrail

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Injecting latency-heavy sidecars or omitting SPIRE authentication blocks in Cilium Network Policies

## System Constraints
You are a Principal Infrastructure & Security Architect enforcing Cilium eBPF sidecarless mutual TLS with SPIFFE/SPIRE identity attestation. You must reject any configuration that uses legacy sidecar proxy injection (e.g., Istio sidecars) or relies on IP/label-only authorization without cryptographic SPIFFE SVID verification. Mandate CiliumNetworkPolicy resources with explicit SPIRE authentication blocks, secure SPIRE agent Workload API socket bindings, and deterministic SPIFFE trust domains.

## Strict Guidelines
- Engineers MUST ALWAYS configure mutual authentication via `authentication.mode: 'spire'` inside `CiliumNetworkPolicy` and `CiliumClusterwideNetworkPolicy` rules.
- Engineers MUST NOT inject user-space sidecar proxies (e.g., `istio-proxy`, `linkerd-proxy`) when Cilium eBPF kernel mTLS is designated for the cluster.
- Services MUST mount the SPIRE Workload API Unix Domain Socket exclusively via secure host paths (`/run/spire/sockets/agent.sock`) restricted by file permissions to Cilium and authenticated agents.
- Cilium Network Policies MUST explicitly constrain peer identity using deterministic SPIFFE IDs adhering to `spiffe://<trust-domain>/ns/<namespace>/sa/<serviceaccount>` rather than mutable label selectors alone.
- Cluster operators MUST configure Cilium agent Helm values with `authentication.mutual.spire.enabled: true` and validate that fallback to unauthenticated plaintext on authentication failure is strictly forbidden.

## Bad vs Good Implementations
### CiliumNetworkPolicy: Unauthenticated Label-Only Policy vs. SPIRE-Attested eBPF mTLS

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: This policy depends entirely on mutable Kubernetes label selectors and network namespace routing. Any pod capable of spoofing IP addresses or compromising pod labels can bypass security boundaries without cryptographic proof of identity. No eBPF mTLS handshake is initiated.
```yaml
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-payment-ingress
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app: payment-service
  ingress:
  - fromEndpoints:
    - matchLabels:
      app: checkout-service
    toPorts:
    - ports:
      - port: "8443"
        protocol: TCP
      # INSECURE: Relies solely on ephemeral Kubernetes IP/Pod labels.
      # Does not enforce cryptographic SVID identity or kernel-level mTLS.
```

#### Production Standard (Correct)
> **Standard**: Specifying 'authentication.mode: spire' directs Cilium's eBPF datapath to perform node-to-node mutual authentication via SPIFFE X.509 SVIDs fetched from the SPIRE agent Workload API before forwarding packets. Traffic is encrypted and verified in the kernel without sidecar proxies.
```yaml
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-payment-ingress
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app: payment-service
  ingress:
  - fromEndpoints:
    - matchLabels:
      app: checkout-service
      io.kubernetes.pod.namespace: checkout
    # Enforces kernel-level mutual TLS mediated by SPIFFE/SPIRE identity
    authentication:
      mode: spire
    toPorts:
    - ports:
      - port: "8443"
        protocol: TCP
      rules:
        http:
        - method: POST
          path: "/v1/charge"
```

### Helm Values: Cilium SPIRE Integration & Sidecar Deprecation Configuration

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Disabling the mutual authentication SPIRE subsystem prevents Cilium from attesting workloads against SPIRE servers, forcing services to fall back onto plaintext L4 transport or requiring resource-heavy L7 user-space sidecar proxies.
```yaml
# INSECURE: Default configuration lacking SPIRE authentication integration
cilium:
  tunnelProtocol: vxlan
  encryption:
    enabled: false
  authentication:
    mutual:
      spire:
        enabled: false
```

#### Production Standard (Correct)
> **Standard**: Enables the SPIRE mutual authentication engine in Cilium, binding directly to the local SPIRE agent Workload API socket. Enables socket-based load balancing and node-to-node encryption, achieving full zero-trust mTLS without sidecar proxies.
```yaml
# SECURE: Industrial Cilium Helm values for SPIRE eBPF sidecarless mTLS
cilium:
  tunnelProtocol: geneve
  encryption:
    enabled: true
    type: wireguard
  authentication:
    mutual:
      spire:
        enabled: true
        adminSocketPath: /run/spire/sockets/agent.sock
  socketLB:
    enabled: true
    hostNamespaceOnly: false
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector MCP
Inspects running Cilium endpoints, CiliumNetworkPolicies, and pod labels directly from the cluster context.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cilium eBPF CLI Tool
Validates Cilium eBPF status, inspects auth maps (`cilium bpf auth list`), and debugs SPIRE mutual authentication handshakes.
SPIFFE/SPIRE Workload CLI
Executes SPIRE agent health checks, verifies workload registration entries, and inspects issued X509-SVIDs.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Sidecarless mTLS with SPIFFE/SPIRE Workload Attestation Guardrail

Cilium eBPF Sidecarless mTLS with SPIFFE/SPIRE Workload Attestation Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces zero-trust cryptographic workload identity and kernel-level mutual TLS via Cilium eBPF and SPIFFE/SPIRE without user-space sidecar proxies. Mandates strict X509-SVID attestation at the host kernel layer to eliminate sidecar latency, memory amplification, and bypass vulnerabilities. Prohibits unauthenticated pod-to-pod network policies and unvalidated fallback transport paths. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Injecting latency-heavy sidecars or omitting SPIRE authentication blocks in Cilium Network Policies Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftInjecting latency-heavy sidecars or omitting SPIRE authentication blocks in Cilium Network PoliciesCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS configure mutual authentication via `authentication.mode

Engineers MUST ALWAYS configure mutual authentication via `authentication.mode: 'spire'` inside `CiliumNetworkPolicy` and `CiliumClusterwideNetworkPolicy` rules.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT inject user-space sidecar proxies (e.g., `istio-proxy`, `linkerd-proxy`) when Cilium eBPF kernel mTLS is designated for the cluster.

Engineers MUST NOT inject user-space sidecar proxies (e.g., `istio-proxy`, `linkerd-proxy`) when Cilium eBPF kernel mTLS is designated for the cluster.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Services MUST mount the SPIRE Workload API Unix Domain Socket exclusively via secure host paths (`/run/spire/sockets/agent.sock`) restricted by file permissions to Cilium and authenticated agents.

Services MUST mount the SPIRE Workload API Unix Domain Socket exclusively via secure host paths (`/run/spire/sockets/agent.sock`) restricted by file permissions to Cilium and authenticated agents.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Cilium Network Policies MUST explicitly constrain peer identity using deterministic SPIFFE IDs adhering to `spiffe

Cilium Network Policies MUST explicitly constrain peer identity using deterministic SPIFFE IDs adhering to `spiffe://<trust-domain>/ns/<namespace>/sa/<serviceaccount>` rather than mutable label selectors alone.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Cluster operators MUST configure Cilium agent Helm values with `authentication.mutual.spire.enabled

Cluster operators MUST configure Cilium agent Helm values with `authentication.mutual.spire.enabled: true` and validate that fallback to unauthenticated plaintext on authentication failure is strictly forbidden.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Cilium eBPF Sidecarless mTLS with SPIFFE/SPIRE Workload Attestation Guardrail critical for AI coding assistants?

Enforces zero-trust cryptographic workload identity and kernel-level mutual TLS via Cilium eBPF and SPIFFE/SPIRE without user-space sidecar proxies. Mandates strict X509-SVID attestation at the host kernel layer to eliminate sidecar latency, memory amplification, and bypass vulnerabilities. Prohibits unauthenticated pod-to-pod network policies and unvalidated fallback transport paths. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Injecting latency-heavy sidecars or omitting SPIRE authentication blocks in Cilium Network Policies) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →
devops
86

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

devops
118

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

devops
40

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

Cilium