Cilium eBPF Socket-Layer Fast-Path mTLS Acceleration Standard

--- description: Cilium eBPF Socket-Layer Fast-Path mTLS Acceleration Standard - Enforces strict socket-layer fast-path architecture in Cilium-managed Kubernetes service meshes to eliminate TCP/IP traversal overhead without bypassing mTLS encryption or cryptographic identity validation. Mandates explicit sockops socket map attachment boundaries, kernel-space connection tracking synchronization, and control-plane attestation via SPIFFE/SPIRE before sockmap redirection. globs: helm/**/values*.yaml, deploy/**/*.yaml, k8s/**/*.yaml, manifests/**/*.yaml, cilium/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-sockops-fastpath-mtls-production-standard" --- # Cilium eBPF Socket-Layer Fast-Path mTLS Acceleration Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Userspace TLS Handshakes via Unchecked Sockops Redirection ## System Constraints You are a Principal Infrastructure and Security Architect enforcing the Cilium eBPF Socket-Layer Fast-Path mTLS Acceleration Standard. When configuring Cilium, eBPF programs, and service mesh networking, you must ensure that socket-layer optimization (BPF_MAP_TYPE_SOCKMAP/SOCKHASH via sockops) never bypasses cryptographic authentication or L7 inspection requirements. Require explicit mutual authentication handshakes before establishing sockops fast-path bypasses, verify Linux kernel kTLS or control-plane attestation integration, and forbid plain sockmap redirection between disjoint cryptographic trust boundaries. ## Strict Guidelines - Engineers MUST ALWAYS enable Cilium mutual authentication ('authentication.mutual.enabled: true') when configuring sockops fast-path redirection across pod boundaries. - Engineers MUST NOT attach sockops redirect programs directly to plaintext sockets when the communication crosses Pod-to-Pod cryptographic boundaries without prior SPIRE/SPIFFE attestation. - Cilium Helm values MUST explicitly enable 'sockops.enabled: true' alongside strict L7 proxy injection or kTLS ('bpf.ktls: true') to prevent the BPF bypass from evading mandatory TLS encryption. - Services MUST declare explicit CiliumNetworkPolicy (CNP) specifications with 'mutualAuth' blocks verifying the peer identity before eBPF fast-path routing is allowed. - Components NEVER short-circuit Envoy or Cilium L7 proxies via sockops when network policies specify HTTP/gRPC inspection rules, as raw socket redirection will bypass user-space proxy enforcement unless upstream kTLS handoffs are configured. - Engineers MUST verify that host kernels support BPF socket lookup and sockmap helper functions ('BPF_FUNC_msg_redirect_hash') without vulnerable kernel regression vectors before enabling node-wide socket-layer enforcement. ## Bad vs Good Implementations ### Cilium Helm Configuration: Insecure Sockops Acceleration vs Secure mTLS-Attested Fast-Path #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Enabling sockops in isolation routes socket traffic directly through BPF_MAP_TYPE_SOCKMAP upon handshake completion. Without Cilium mutual authentication or explicit Envoy-to-socket policy enforcement, cross-workload traffic bypasses TLS termination and cryptographic identity checks, transmitting unencrypted payloads directly across socket buffers. ```yaml # INSECURE: Enables sockops fast-path without mutual auth or proxy synchronization. # Traffic between pods on the same node short-circuits userspace proxies completely, # exposing unencrypted payload directly in sockmap and dropping mTLS context. kubeProxyReplacement: "true" bpf: sockopsEnable: true routingMode: "native" envoy: enabled: true # Missing mutual authentication, kTLS, and identity validation integration ``` #### Production Standard (Correct) > **Standard**: This configuration pairs socket-layer acceleration with Cilium's SPIFFE/SPIRE mutual authentication infrastructure and WireGuard/IPsec fallback. Pod identities are cryptographically attested prior to socket fast-path authorization, ensuring that L7 visibility and encryption guarantees remain invariant. ```yaml # SECURE: Sockops fast-path gated by Cilium Mutual Authentication and SPIRE/SPIFFE attestation. kubeProxyReplacement: "true" routingMode: "native" bpf: sockopsEnable: true tproxy: true authentication: mutual: enabled: true spire: enabled: true install: enabled: false agentSocketPath: "/run/spire/sockets/agent.sock" envoy: enabled: true tls: secretsBackend: "k8s" encryption: enabled: true type: wireguard nodeEncryption: true ``` ### CiliumNetworkPolicy: Enforcing Cryptographic Handshake Before Socket-Layer Permitted Flow #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This policy allows traffic based entirely on Kubernetes labels. Under sockops fast-path, malicious workloads impersonating the checkout label on the same node can be injected into the sockmap without presenting cryptographic x509/SPIFFE proofs. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: allow-internal-fastpath spec: endpointSelector: matchLabels: app: payment-service ingress: - fromEndpoints: - matchLabels: app: checkout-service # ANTI-PATTERN: Plain ingress rule with no authentication mandate. # When sockops is active, BPF redirects connections between checkout and payment # purely based on 4-tuple without cryptographic identity attestation. ``` #### Production Standard (Correct) > **Standard**: The policy requires mutual authentication ('mode: required') and enforces L7 HTTP rules. Cilium coordinates with the SPIRE node agent to establish mTLS session keys before the socket-layer fast path or proxy filter pipelines are granted access to socket buffers. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: allow-internal-fastpath spec: endpointSelector: matchLabels: app: payment-service ingress: - fromEndpoints: - matchLabels: app: checkout-service authentication: mode: "required" toPorts: - ports: - port: "8443" protocol: TCP rules: http: - method: "POST" path: "/v1/charge" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Socket-Layer Fast-Path mTLS Acceleration Standard

Cilium eBPF Socket-Layer Fast-Path mTLS Acceleration Standard defines an industrial-grade behavioral standard for devops engineering. Enforces strict socket-layer fast-path architecture in Cilium-managed Kubernetes service meshes to eliminate TCP/IP traversal overhead without bypassing mTLS encryption or cryptographic identity validation. Mandates explicit sockops socket map attachment boundaries, kernel-space connection tracking synchronization, and control-plane attestation via SPIFFE/SPIRE before sockmap redirection. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Userspace TLS Handshakes via Unchecked Sockops Redirection Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Userspace TLS Handshakes via Unchecked Sockops Redirection	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enable Cilium mutual authentication ('authentication.mutual.enabled

Engineers MUST ALWAYS enable Cilium mutual authentication ('authentication.mutual.enabled: true') when configuring sockops fast-path redirection across pod boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.