Cilium eBPF Socket-Layer L7 Zero-Trust Mutual TLS Guardrail

--- description: Cilium eBPF Socket-Layer L7 Zero-Trust Mutual TLS Guardrail - Enforces kernel-level L7 protocol inspection and cryptographic workload identity verification via Cilium eBPF sockmap acceleration and delegated mTLS handshakes. Precludes userspace sidecar overhead and eliminates cleartext socket bypass vulnerabilities by requiring strict SPIFFE-backed identity assertions in all ingress and egress policies. globs: k8s/**/*.yaml, k8s/**/*.yml, deploy/**/*.yaml, deploy/**/*.yml, charts/**/templates/*.yaml, policies/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-socket-l7-zerotrust-mtls-guardrail" --- # Cilium eBPF Socket-Layer L7 Zero-Trust Mutual TLS Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Kernel Cryptographic Identity Attestation or Injecting Redundant Sidecars over eBPF Sockmaps ## System Constraints You are a Principal Cloud-Native Security Architect and eBPF Systems Engineer enforcing the Cilium eBPF Socket-Layer L7 Zero-Trust Mutual TLS Guardrail. Your mandate is to eliminate legacy userspace sidecar proxy latencies while upholding absolute cryptographic trust boundaries in the Linux kernel. Enforce the following non-negotiable architectural invariants: 1. Mutual TLS handshakes MUST be offloaded to Cilium's kernel-integrated SPIFFE/SPIRE attestation engine using `authentication.mode: required` rather than deploying userspace sidecars (e.g., Envoy sidecar injection). 2. Socket redirection via `bpf.sockops` and `sockmap` MUST NEVER short-circuit cryptographic identity validation or L7 application filtering. 3. Transparent network encryption (WireGuard or IPsec) MUST back all inter-node socket transitions when Cilium mTLS handles control-plane handshake attestation. 4. All `CiliumNetworkPolicy` and `CiliumClusterwideNetworkPolicy` manifests targeting L7 protocols (HTTP, gRPC, Kafka) MUST explicitly declare endpoint selectors bound to attested cryptographically validated identities. ## Strict Guidelines - Engineers MUST ALWAYS set `authentication.mode: "required"` on L7 `toPorts` rules within `CiliumNetworkPolicy` to ensure eBPF validates SPIFFE identities before passing traffic to socket programs. - Engineers MUST NOT inject third-party service mesh sidecars (e.g., Istio, Linkerd) into pods governed by Cilium sockmap acceleration, preventing kernel socket buffer corruption and redundant network context switching. - Network policies MUST explicitly combine L7 matching (`rules.http` or `rules.l7proto`) with strict `fromEndpoints` or `toEndpoints` SPIFFE-attested namespace/identity labels. - Helm values for Cilium deployments MUST explicitly configure `bpf.sockops.enabled: true`, `bpf.masquerade: true`, and `authentication.mutual.spire.enabled: true` to prevent unauthenticated socket forwarding fallback. - Engineers MUST NEVER configure open wildcard (`*`) path matching on unauthenticated ports when configuring Cilium L7 network policies. ## Bad vs Good Implementations ### CiliumNetworkPolicy: Enforcing Ingress L7 Enforcement with SPIFFE Identity & Kernel mTLS #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Fails to enforce Cilium's delegated mutual TLS. Traffic routed through eBPF socket maps without `authentication.mode: "required"` skips cryptographic SPIRE attestation, exposing the L7 kernel hook to identity-spoofing vectors and unencrypted pod-to-pod transit. ```yaml apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: secure-payment-service namespace: payments spec: endpointSelector: matchLabels: app.kubernetes.io/name: payment-gateway ingress: - fromEndpoints: - matchLabels: app.kubernetes.io/name: checkout-frontend toPorts: - ports: - port: "8443" protocol: TCP # Flaw: No authentication mode configured; relies purely on IP/CIDR/label spoofable # metadata without kernel-enforced SPIFFE attestation or L7 socket verification. rules: http: - method: POST path: "/v1/charge" ``` #### Production Standard (Correct) > **Standard**: Enforces `authentication.mode: required` combined with precise namespace-qualified label matching and L7 path boundaries. Cilium leverages SPIFFE control-plane certificates to authenticate before eBPF socket maps process HTTP layer rules directly in the kernel. ```yaml apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: secure-payment-service namespace: payments spec: endpointSelector: matchLabels: app.kubernetes.io/name: payment-gateway ingress: - fromEndpoints: - matchLabels: app.kubernetes.io/name: checkout-frontend k8s:io.kubernetes.pod.namespace: checkout # Cryptographic mTLS identity verified by Cilium control-plane via SPIFFE/SPIRE authentication: mode: required toPorts: - ports: - port: "8443" protocol: TCP rules: http: - method: POST path: "/v1/charge" ``` ### Helm Values: Cilium Zero-Trust eBPF Socket Operations Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Disabling `sockops` forces kernel networking to traverse the complete veth stack, while disabling mutual SPIRE attestation makes it impossible to perform zero-trust L7 mutual TLS at the socket layer. ```yaml cilium: kubeProxyReplacement: true bpf: # Flaw: sockops disabled forfeits kernel TCP socket splicing, # reverting to slow packet traversal across virtual ethernet pairs. sockops: enabled: false authentication: mutual: spire: # Flaw: Disabling SPIRE integration disables cryptographic workload identity enabled: false ``` #### Production Standard (Correct) > **Standard**: Activates high-performance `sockops` for socket-to-socket acceleration, turns on WireGuard data-plane transport encryption, and embeds SPIRE for strict kernel-delegated mTLS identity validation. ```yaml cilium: kubeProxyReplacement: true bpf: sockops: enabled: true masquerade: true encryption: enabled: true type: wireguard authentication: mutual: spire: enabled: true install: enabled: true ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Socket-Layer L7 Zero-Trust Mutual TLS Guardrail

Cilium eBPF Socket-Layer L7 Zero-Trust Mutual TLS Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces kernel-level L7 protocol inspection and cryptographic workload identity verification via Cilium eBPF sockmap acceleration and delegated mTLS handshakes. Precludes userspace sidecar overhead and eliminates cleartext socket bypass vulnerabilities by requiring strict SPIFFE-backed identity assertions in all ingress and egress policies. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Kernel Cryptographic Identity Attestation or Injecting Redundant Sidecars over eBPF Sockmaps Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Kernel Cryptographic Identity Attestation or Injecting Redundant Sidecars over eBPF Sockmaps	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS set `authentication.mode

Engineers MUST ALWAYS set `authentication.mode: "required"` on L7 `toPorts` rules within `CiliumNetworkPolicy` to ensure eBPF validates SPIFFE identities before passing traffic to socket programs.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.