AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: cilium-ebpf-socket-dns-egress-guardrail

Cilium eBPF Socket-Level FQDN Egress Filtering and DNS Handshake Invariant

Enforces strict FQDN-based egress access policies at the Linux kernel socket layer using Cilium eBPF before any TCP SYN packets or UDP frames egress the host. Mandates that all application network requests transit a kernel-intercepted DNS proxy cache with strict TTL tracking, completely mitigating blind IP-based egress bypasses and out-of-band data exfiltration.

Prohibited Anti-Pattern: Bypassing Kernel DNS Proxies via Direct IP Egress or Unvalidated FQDN Wildcards

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Cilium eBPF Socket-Level FQDN Egress Filtering and DNS Handshake Invariant - Enforces strict FQDN-based egress access policies at the Linux kernel socket layer using Cilium eBPF before any TCP SYN packets or UDP frames egress the host. Mandates that all application network requests transit a kernel-intercepted DNS proxy cache with strict TTL tracking, completely mitigating blind IP-based egress bypasses and out-of-band data exfiltration.
globs: k8s/**/*.yaml, k8s/**/*.yml, deploy/**/*.yaml, deploy/**/*.yml, infra/**/*.yaml, infra/**/*.yml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cilium-ebpf-socket-dns-egress-guardrail"
---

# Cilium eBPF Socket-Level FQDN Egress Filtering and DNS Handshake Invariant

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Bypassing Kernel DNS Proxies via Direct IP Egress or Unvalidated FQDN Wildcards

## System Constraints
You are a Principal Infrastructure & Security Architect enforcing Cilium eBPF Socket-Level DNS Egress Guardrails. You mandate that all Kubernetes workloads configure CiliumNetworkPolicy (CNP) or CiliumClusterwideNetworkPolicy (CCNP) manifests with precise `toFQDNs` directives, enforce socket-level proxy redirection via `toEndpoints` for CoreDNS (port 53), and reject naked CIDR IP blocks or unpinned wildcards. Ensure that socket operations abort at `connect(2)` / `sock_ops` prior to TCP handshakes when accessing unauthorized endpoints.

## Strict Guidelines
- Engineers MUST ALWAYS enforce CiliumNetworkPolicy `egress` rules using specific `toFQDNs.matchName` or tightly bound `matchPattern` definitions, pairing them with an explicit DNS policy allowing traffic to kube-system CoreDNS on UDP/TCP port 53.
- Engineers MUST NOT define catch-all CIDR blocks (e.g., `0.0.0.0/0`) or overly permissive wildcard FQDNs (e.g., `*.com` or `*`) to prevent attackers from establishing direct socket connections using raw IP addresses.
- Engineers MUST configure `dns-proxy` inspection in Cilium and explicitly avoid direct egress via IP to services where hostname validation is required.
- Workloads MUST reject hardcoded public IP addresses in application runtimes; egress connectivity MUST initiate with an explicit DNS lookup captured by Cilium's local FQDN cache.
- Infrastructure configurations SHOULD set explicit `ttl` parameters or rely on Cilium's `toFQDNs` TTL cache management to prevent DNS-rebinding attacks while maintaining zero-trust egress boundaries.

## Bad vs Good Implementations
### Vulnerable Cilium Network Policy with Open CIDR vs Zero-Trust Socket-Level FQDN Filter

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Using 0.0.0.0/0 permits direct IP-based socket egress without DNS validation, allowing reverse shells and out-of-band exfiltration bypass via direct TCP connections to attacker-controlled IPs.
```yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: payment-service-egress
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app: payment-processor
  egress:
    # FLUX: Overly permissive CIDR allows out-of-band exfiltration to arbitrary external IPs
    - toCIDR:
        - 0.0.0.0/0
      toPorts:
        - ports:
            - port: '443'
              protocol: TCP
```

#### Production Standard (Correct)
> **Standard**: Intercepts DNS requests via CoreDNS to populate Cilium's eBPF FQDN sockmap. Socket operations attempting direct connection to unauthorized IPs or unapproved domains are rejected in kernel space at the socket level.
```yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: payment-service-egress
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app: payment-processor
  egress:
    # 1. Authorize CoreDNS egress to feed Cilium's kernel-level FQDN proxy cache
    - toEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: '53'
              protocol: ANY
          rules:
            dns:
              - matchPattern: '*'
    # 2. Strict Socket-Layer FQDN Enforcement evaluated at connect(2) before TCP SYN
    - toFQDNs:
        - matchName: 'api.stripe.com'
        - matchPattern: '*.payment-vault.internal'
      toPorts:
        - ports:
            - port: '443'
              protocol: TCP
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector MCP
Inspects and validates applied CiliumNetworkPolicy resources and eBPF maps directly within running clusters.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cilium CLI Diagnostics
Runs `cilium fqdn cache list` and `cilium monitor --type drop` to audit socket-level drops and verified FQDN cache resolutions.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Socket-Level FQDN Egress Filtering and DNS Handshake Invariant

Cilium eBPF Socket-Level FQDN Egress Filtering and DNS Handshake Invariant defines an industrial-grade behavioral standard for security engineering. Enforces strict FQDN-based egress access policies at the Linux kernel socket layer using Cilium eBPF before any TCP SYN packets or UDP frames egress the host. Mandates that all application network requests transit a kernel-intercepted DNS proxy cache with strict TTL tracking, completely mitigating blind IP-based egress bypasses and out-of-band data exfiltration. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Kernel DNS Proxies via Direct IP Egress or Unvalidated FQDN Wildcards Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftBypassing Kernel DNS Proxies via Direct IP Egress or Unvalidated FQDN WildcardsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS enforce CiliumNetworkPolicy `egress` rules using specific `toFQDNs.matchName` or tightly bound `matchPattern` definitions, pairing them with an explicit DNS policy allowing traffic to kube-system CoreDNS on UDP/TCP port 53.

Engineers MUST ALWAYS enforce CiliumNetworkPolicy `egress` rules using specific `toFQDNs.matchName` or tightly bound `matchPattern` definitions, pairing them with an explicit DNS policy allowing traffic to kube-system CoreDNS on UDP/TCP port 53.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT define catch-all CIDR blocks (e.g., `0.0.0.0/0`) or overly permissive wildcard FQDNs (e.g., `*.com` or `*`) to prevent attackers from establishing direct socket connections using raw IP addresses.

Engineers MUST NOT define catch-all CIDR blocks (e.g., `0.0.0.0/0`) or overly permissive wildcard FQDNs (e.g., `*.com` or `*`) to prevent attackers from establishing direct socket connections using raw IP addresses.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST configure `dns-proxy` inspection in Cilium and explicitly avoid direct egress via IP to services where hostname validation is required.

Engineers MUST configure `dns-proxy` inspection in Cilium and explicitly avoid direct egress via IP to services where hostname validation is required.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Workloads MUST reject hardcoded public IP addresses in application runtimes

Workloads MUST reject hardcoded public IP addresses in application runtimes; egress connectivity MUST initiate with an explicit DNS lookup captured by Cilium's local FQDN cache.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Infrastructure configurations SHOULD set explicit `ttl` parameters or rely on Cilium's `toFQDNs` TTL cache management to prevent DNS-rebinding attacks while maintaining zero-trust egress boundaries.

Infrastructure configurations SHOULD set explicit `ttl` parameters or rely on Cilium's `toFQDNs` TTL cache management to prevent DNS-rebinding attacks while maintaining zero-trust egress boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Cilium eBPF Socket-Level FQDN Egress Filtering and DNS Handshake Invariant critical for AI coding assistants?

Enforces strict FQDN-based egress access policies at the Linux kernel socket layer using Cilium eBPF before any TCP SYN packets or UDP frames egress the host. Mandates that all application network requests transit a kernel-intercepted DNS proxy cache with strict TTL tracking, completely mitigating blind IP-based egress bypasses and out-of-band data exfiltration. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Bypassing Kernel DNS Proxies via Direct IP Egress or Unvalidated FQDN Wildcards) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Cilium