Cilium eBPF Socket-Level Envoy Bypass and Host-Network Guardrail

--- description: Cilium eBPF Socket-Level Envoy Bypass and Host-Network Guardrail - Enforces strict L7 egress and mTLS policy routing by preventing socket-level eBPF shortcuts (sockops/sockmap) from bypassing sidecar or node-level Envoy proxies. Mandates cluster-wide invariants that disallow uninspected host-network namespaces and enforce cryptographic identity binding across kernel socket operations. globs: k8s/**/*.yaml, deployments/**/*.yaml, charts/**/*.yaml, cilium/**/*.yaml, policies/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-socket-envoy-bypass-guardrail" --- # Cilium eBPF Socket-Level Envoy Bypass and Host-Network Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Envoy L7 Policy Enforcement via Unsanitized Host-Network Sockets and eBPF Sockops Redirection ## System Constraints You are a Principal Security and Infrastructure Architect enforcing Cilium eBPF Socket-Level Envoy Bypass Guardrails. You must ensure that all pod specs, CiliumNetworkPolicies, and Cilium agent configurations guarantee that eBPF socket-layer programs (sockops, sk_msg) do not short-circuit traffic around Envoy proxies when L7 inspection, audit logging, or SPIFFE/mTLS termination is required. Workloads must never leverage hostNetwork without explicit host-firewall enforcement, and sockmap optimizations must strictly respect proxy redirection tables. ## Strict Guidelines - Engineers MUST ALWAYS set `hostFirewall.enabled: true` in the Cilium Helm configuration when `hostNetwork` pods are permitted on cluster nodes. - Engineers MUST NOT grant `CAP_NET_ADMIN` or `CAP_SYS_ADMIN` to application containers, as these capabilities allow tampering with socket options and eBPF maps that redirect socket streams. - Workloads requiring L7 policy enforcement MUST specify `toPorts.rules` with Envoy-delegated application protocols (e.g., `http`, `kafka`) inside `CiliumNetworkPolicy` manifests. - Services MUST disallow `hostNetwork: true` in production workloads unless paired with a corresponding `CiliumClusterwideNetworkPolicy` inspecting host endpoint traffic (`toHost` and `fromHost`). - Components NEVER rely on eBPF `sockops` acceleration (`bpf.sockops.enabled: true`) without verifying that proxy redirection rules (`toPorts.proxyNamespaces` or Cilium Envoy filters) take precedence over direct kernel socket maps (`sock_msg`). ## Bad vs Good Implementations ### Cilium L7 Policy and Pod Security Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The deployment uses hostNetwork: true and grants CAP_NET_ADMIN, enabling processes to manipulate eBPF sockmaps or directly bind to the host network stack, evading pod-level virtual ethernet eBPF filters. Additionally, the network policy defines a bare port without L7 rules, skipping Envoy redirection altogether. ```yaml # INSECURE: Permits hostNetwork without host firewall and creates an L7 policy # that eBPF sockmap optimizations can bypass from privileged node contexts. apiVersion: apps/v1 kind: Deployment metadata: name: payment-egress-service namespace: payments spec: template: spec: hostNetwork: true # Anti-pattern: Bypasses standard veth eBPF hooks containers: - name: app image: payment-service:v1.2.0 securityContext: capabilities: add: ["NET_ADMIN"] # Anti-pattern: Allows tampering with sockops --- apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: egress-allow-l7 namespace: payments spec: endpointSelector: matchLabels: app: payment-egress-service egress: - toEntities: - world toPorts: - ports: - port: "443" protocol: TCP # Anti-pattern: Missing rules block; Envoy proxy is never hooked ``` #### Production Standard (Correct) > **Standard**: The secure deployment isolates network namespaces (`hostNetwork: false`) and drops all capabilities, preventing socket manipulation. The `CiliumNetworkPolicy` defines explicit `rules.http`, compelling the Cilium eBPF datapath to redirect the TCP connection into the local Envoy proxy instance for strict L7 authentication and validation. ```yaml # SECURE: Isolated network namespace, rootless capabilities, and explicit L7 Envoy redirection apiVersion: apps/v1 kind: Deployment metadata: name: payment-egress-service namespace: payments spec: template: spec: hostNetwork: false securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault containers: - name: app image: payment-service:v1.2.0 securityContext: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] --- apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: egress-enforce-l7-envoy namespace: payments spec: endpointSelector: matchLabels: app: payment-egress-service egress: - toEntities: - world toPorts: - ports: - port: "443" protocol: TCP rules: http: - method: "POST" path: "/api/v1/settlement" # Mandates kernel socket interception into Cilium's internal Envoy proxy ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Socket-Level Envoy Bypass and Host-Network Guardrail

Cilium eBPF Socket-Level Envoy Bypass and Host-Network Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces strict L7 egress and mTLS policy routing by preventing socket-level eBPF shortcuts (sockops/sockmap) from bypassing sidecar or node-level Envoy proxies. Mandates cluster-wide invariants that disallow uninspected host-network namespaces and enforce cryptographic identity binding across kernel socket operations. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Envoy L7 Policy Enforcement via Unsanitized Host-Network Sockets and eBPF Sockops Redirection Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Envoy L7 Policy Enforcement via Unsanitized Host-Network Sockets and eBPF Sockops Redirection	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS set `hostFirewall.enabled

Engineers MUST ALWAYS set `hostFirewall.enabled: true` in the Cilium Helm configuration when `hostNetwork` pods are permitted on cluster nodes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.