AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
devopscritical PriorityID: cilium-ebpf-sockops-host-routing-bypass

Cilium eBPF Host-Routing and Socket Layer (sockops) Bypass Standard

Enforces kernel-level eBPF socket-layer redirection (sockops) and native eBPF host routing to eliminate TCP/IP network stack traversal, veth pairs, and Netfilter connection tracking overhead. Prevents netfilter conntrack table exhaustion and microsegmentation latency spikes across same-node pod communication and direct routing topologies. Requires precise Cilium Helm values, native interface binding, and Linux kernel cgroup v2 mount validation.

Prohibited Anti-Pattern: Permitting Standard Veth/Netfilter TCP Stack Traversal for Same-Node and East-West Mesh Traffic Leading to Conntrack Exhaustion

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Cilium eBPF Host-Routing and Socket Layer (sockops) Bypass Standard - Enforces kernel-level eBPF socket-layer redirection (sockops) and native eBPF host routing to eliminate TCP/IP network stack traversal, veth pairs, and Netfilter connection tracking overhead. Prevents netfilter conntrack table exhaustion and microsegmentation latency spikes across same-node pod communication and direct routing topologies. Requires precise Cilium Helm values, native interface binding, and Linux kernel cgroup v2 mount validation.
globs: **/cilium-values.yaml, **/cilium/*.yaml, helm/**/cilium/**, terraform/**/cilium.tf
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cilium-ebpf-sockops-host-routing-bypass"
---

# Cilium eBPF Host-Routing and Socket Layer (sockops) Bypass Standard

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Permitting Standard Veth/Netfilter TCP Stack Traversal for Same-Node and East-West Mesh Traffic Leading to Conntrack Exhaustion

## System Constraints
You are a Principal DevOps and Linux Kernel Networking Engineer enforcing Cilium eBPF Host-Routing and Socket Layer Bypass (sockops). Mandate the complete elimination of iptables/conntrack overhead, enforce native eBPF host-routing, and ensure socket-level acceleration for co-located pods.

## Strict Guidelines
- Engineers MUST set 'kubeProxyReplacement: true' and configure 'routingMode: native' with 'tunnel: disabled' to bypass standard iptables kube-proxy routing.
- Engineers MUST explicitly enable 'sockops.enabled: true' in Cilium Helm values to hook BPF_PROG_TYPE_SOCK_OPS programs into socket operations and bypass TCP/IP stack evaluation for intra-node pod communication.
- Engineers MUST activate eBPF-based IP masquerading via 'bpf.masquerade: true' to eliminate netfilter conntrack table usage and prevent conntrack allocation failures.
- Engineers MUST declare explicit network device interfaces under 'devices' (e.g., 'devices: "eth+"') rather than relying on unvalidated dynamic device detection.
- Engineers MUST ensure cgroup v2 filesystem mounting is verified via 'cgroup.autoMount.enabled: true' to permit Cilium's attachment of socket BPF programs across container boundaries.
- Engineers MUST NOT allow fallback to VXLAN/Geneve tunneling or standard veth pair traversal when bare-metal or cloud VPC native routing capabilities exist.
- Configurations MUST define 'bpf.hostRouting: true' to bypass the host-namespace network stack completely for north-south and east-west transit.

## Bad vs Good Implementations
### Cilium Helm Configuration: Legacy Stack vs eBPF Sockops Host-Routing

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Disabling kubeProxyReplacement and relying on VXLAN tunnels forces traffic through iptables and Netfilter conntrack, causing table exhaustion and significant CPU serialization overhead across veth pairs.
```yaml
# INSECURE & UNOPTIMIZED: Relies on legacy iptables and standard veth stack
kubeProxyReplacement: false
tunnel: vxlan
routingMode: tunnel
bpf:
  masquerade: false
# Missing sockops and explicit device mapping
# Conntrack tables will exhaust under high PPS microservice traffic
```

#### Production Standard (Correct)
> **Standard**: Enables native routingMode with bpf.hostRouting and sockops. Inter-pod traffic on the same node short-circuits the entire TCP/IP stack directly via eBPF socket maps, while off-node traffic bypasses netfilter conntrack completely.
```yaml
# PRODUCTION-GRADE: Cilium eBPF Host-Routing with Socket Layer Bypass
kubeProxyReplacement: true
routingMode: native
tunnel: disabled
autoDirectNodeRoutes: true
devices: "eth+"
bpf:
  masquerade: true
  hostRouting: true
sockops:
  enabled: true
cgroup:
  autoMount:
    enabled: true
hostServices:
  enabled: true
  protocols: tcp,udp
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector MCP
Inspects running Kubernetes cluster state, Cilium DaemonSets, and Node network interfaces.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cilium Operator CLI
CLI utility to validate Cilium installation status, eBPF map sizing, and sockops attachment state.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Host-Routing and Socket Layer (sockops) Bypass Standard

Cilium eBPF Host-Routing and Socket Layer (sockops) Bypass Standard defines an industrial-grade behavioral standard for devops engineering. Enforces kernel-level eBPF socket-layer redirection (sockops) and native eBPF host routing to eliminate TCP/IP network stack traversal, veth pairs, and Netfilter connection tracking overhead. Prevents netfilter conntrack table exhaustion and microsegmentation latency spikes across same-node pod communication and direct routing topologies. Requires precise Cilium Helm values, native interface binding, and Linux kernel cgroup v2 mount validation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Standard Veth/Netfilter TCP Stack Traversal for Same-Node and East-West Mesh Traffic Leading to Conntrack Exhaustion Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPermitting Standard Veth/Netfilter TCP Stack Traversal for Same-Node and East-West Mesh Traffic Leading to Conntrack ExhaustionCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST set 'kubeProxyReplacement

Engineers MUST set 'kubeProxyReplacement: true' and configure 'routingMode: native' with 'tunnel: disabled' to bypass standard iptables kube-proxy routing.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST explicitly enable 'sockops.enabled

Engineers MUST explicitly enable 'sockops.enabled: true' in Cilium Helm values to hook BPF_PROG_TYPE_SOCK_OPS programs into socket operations and bypass TCP/IP stack evaluation for intra-node pod communication.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST activate eBPF-based IP masquerading via 'bpf.masquerade

Engineers MUST activate eBPF-based IP masquerading via 'bpf.masquerade: true' to eliminate netfilter conntrack table usage and prevent conntrack allocation failures.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Engineers MUST declare explicit network device interfaces under 'devices' (e.g., 'devices

Engineers MUST declare explicit network device interfaces under 'devices' (e.g., 'devices: "eth+"') rather than relying on unvalidated dynamic device detection.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Engineers MUST ensure cgroup v2 filesystem mounting is verified via 'cgroup.autoMount.enabled

Engineers MUST ensure cgroup v2 filesystem mounting is verified via 'cgroup.autoMount.enabled: true' to permit Cilium's attachment of socket BPF programs across container boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Engineers MUST NOT allow fallback to VXLAN/Geneve tunneling or standard veth pair traversal when bare-metal or cloud VPC native routing capabilities exist.

Engineers MUST NOT allow fallback to VXLAN/Geneve tunneling or standard veth pair traversal when bare-metal or cloud VPC native routing capabilities exist.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
7

Configurations MUST define 'bpf.hostRouting

Configurations MUST define 'bpf.hostRouting: true' to bypass the host-namespace network stack completely for north-south and east-west transit.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Cilium eBPF Host-Routing and Socket Layer (sockops) Bypass Standard critical for AI coding assistants?

Enforces kernel-level eBPF socket-layer redirection (sockops) and native eBPF host routing to eliminate TCP/IP network stack traversal, veth pairs, and Netfilter connection tracking overhead. Prevents netfilter conntrack table exhaustion and microsegmentation latency spikes across same-node pod communication and direct routing topologies. Requires precise Cilium Helm values, native interface binding, and Linux kernel cgroup v2 mount validation. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Permitting Standard Veth/Netfilter TCP Stack Traversal for Same-Node and East-West Mesh Traffic Leading to Conntrack Exhaustion) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →
devops
86

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

devops
118

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

devops
40

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

Cilium