Cilium eBPF Socket-Level Mutual TLS and Kernel Data-Path Enforcement

--- description: Cilium eBPF Socket-Level Mutual TLS and Kernel Data-Path Enforcement - Enforces Cilium native eBPF socket-level mutual authentication and kernel-level wire encryption, eliminating the performance penalties of userspace Envoy sidecars. Guarantees cryptographic identity verification at the Linux kernel sockops layer while bypassing userspace context switches for ultra-low latency service mesh networking. globs: **/templates/**/*.yaml, **/manifests/**/*.yaml, **/cilium/**/*.yaml, **/k8s/**/*.yaml, **/helm/**/values.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-socket-mtls-enforcement" --- # Cilium eBPF Socket-Level Mutual TLS and Kernel Data-Path Enforcement > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Injecting Heavy Userspace Envoy Sidecars for Pod-to-Pod mTLS Instead of Kernel-Level eBPF Socket Redirection ## System Constraints You are a Principal Infrastructure Architect enforcing Cilium eBPF Layer 7 Socket-Level Mutual TLS Enforcement. You must ensure all service-to-service authentication leverages Cilium's native mutual authentication control plane with eBPF sockops data paths. Reject traditional userspace sidecar proxies (e.g., Istio/Envoy sidecars) for internal traffic, mandate strict SPIFFE/SPIRE identity attestation, and enforce fail-closed cryptographic invariants directly in CiliumNetworkPolicy manifests. ## Strict Guidelines - Engineers MUST ALWAYS configure `authentication.mode: required` in `CiliumNetworkPolicy` specs to enforce kernel-verified mutual authentication. - Engineers MUST NOT deploy per-pod userspace proxy sidecars (e.g., Envoy/Istio sidecars) for internal pod-to-pod mutual TLS. - Cilium Helm configurations MUST enable `sockops.enabled: true` and `authentication.mutual.spire.enabled: true` to permit kernel socket-level routing and SPIRE attestation. - Services MUST attest cryptographic identities using SPIFFE IDs issued via Cilium-integrated SPIRE node agents rather than mounting long-lived static secrets in pods. - Security policies NEVER permit unauthenticated fallback; policies MUST drop packets at the eBPF layer if the handshake state is missing or invalid. ## Bad vs Good Implementations ### Cilium Network Policy with eBPF Socket-Level mTLS Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This policy forces traffic through Cilium's userspace Envoy filter without enforcing cryptographic mutual authentication in the kernel, adding millisecond tail latencies from userspace context switches while failing to verify client SPIFFE identity cryptographically. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: secure-payment-service namespace: production spec: endpointSelector: matchLabels: app: payment-service ingress: - fromEndpoints: - matchLabels: app: checkout-service toPorts: - ports: - port: "8443" protocol: TCP rules: # ANTI-PATTERN: Forcing L7 HTTP rules into userspace Envoy proxy # without mutual auth enforcement causes userspace context-switch overhead http: - method: POST path: "/v1/charge" ``` #### Production Standard (Correct) > **Standard**: Specifying `authentication.mode: "required"` mandates that Cilium's mutual auth control plane verifies node/workload SPIFFE identity before plumbing the eBPF sockops BPF map. Authorized traffic passes directly through kernel socket buffers without user-space sidecar traversal. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: secure-payment-service namespace: production spec: endpointSelector: matchLabels: app: payment-service ingress: - fromEndpoints: - matchLabels: app: checkout-service # INVARIANT: Mutual authentication enforced in kernel control plane authentication: mode: "required" toPorts: - ports: - port: "8443" protocol: TCP # Terminated via socket-level sockops redirection without userspace sidecar rules: http: - method: POST path: "/v1/charge" ``` ### Cilium Helm Configuration for Socket Acceleration and SPIRE Integration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Disabling sockops and SPIRE integration forces network traffic through full TCP/IP network stack processing and denies Cilium the ability to establish kernel-level mutual authentication. ```yaml # ANTI-PATTERN: Legacy proxy configuration using standard TCP stack and manual certs cilium: sockops: enabled: false encryption: enabled: false authentication: mutual: spire: enabled: false ``` #### Production Standard (Correct) > **Standard**: Enables eBPF sockops to bypass TCP/IP stack overhead for local pods, enables WireGuard for wire-level data plane encryption, and integrates SPIRE for out-of-band mutual authentication token exchange. ```yaml # INVARIANT: Enable socket-level acceleration and SPIRE-driven mTLS sockops: enabled: true routingMode: native encryption: enabled: true type: wireguard authentication: mutual: spire: enabled: true install: enabled: true adminSocketPath: /run/spire/sockets/admin.sock ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Socket-Level Mutual TLS and Kernel Data-Path Enforcement

Cilium eBPF Socket-Level Mutual TLS and Kernel Data-Path Enforcement defines an industrial-grade behavioral standard for devops engineering. Enforces Cilium native eBPF socket-level mutual authentication and kernel-level wire encryption, eliminating the performance penalties of userspace Envoy sidecars. Guarantees cryptographic identity verification at the Linux kernel sockops layer while bypassing userspace context switches for ultra-low latency service mesh networking. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Injecting Heavy Userspace Envoy Sidecars for Pod-to-Pod mTLS Instead of Kernel-Level eBPF Socket Redirection Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Injecting Heavy Userspace Envoy Sidecars for Pod-to-Pod mTLS Instead of Kernel-Level eBPF Socket Redirection	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure `authentication.mode

Engineers MUST ALWAYS configure `authentication.mode: required` in `CiliumNetworkPolicy` specs to enforce kernel-verified mutual authentication.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.