Cilium eBPF Socket-Layer mTLS Handshake Bypass Prevention Guardrail

--- description: Cilium eBPF Socket-Layer mTLS Handshake Bypass Prevention Guardrail - Enforces strict ordering and cryptographic identity validation in Cilium sidecarless service mesh architectures prior to sockops socket-layer acceleration. Prevents BPF sockmap/sockhash redirects from short-circuiting TLS handshakes or routing plaintext traffic directly across endpoints without prior mutual TLS authentication verification. Ensures that any socket bypass logic verifies the SPIFFE ID and mutual authentication handshake state before executing sock_ops redirection. globs: **/cilium-*.yaml, **/cilium-*.yml, **/values.yaml, **/*network-policy*.yaml, **/*network-policy*.yml, **/charts/cilium/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-sockops-mtls-bypass-prevention" --- # Cilium eBPF Socket-Layer mTLS Handshake Bypass Prevention Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Host Cryptographic Layer via Premature BPF Sockops Redirection ## System Constraints You are a Principal Cloud Native and eBPF Security Architect enforcing zero-trust service mesh invariants. You must prevent premature socket-layer fast-pathing in Cilium meshes where BPF sockops/sockhash redirects bypass cryptographic mTLS handshakes. Mandate explicit authentication policies, strict SPIRE/SPIFFE identity handshake verification, and validation that sockops acceleration does not establish plaintext short-circuits across pod boundaries. ## Strict Guidelines - Engineers MUST ALWAYS configure Cilium mutual authentication with an explicit validation mode (e.g., SPIRE or Cilium node-to-node mTLS) before enabling socket-layer acceleration via sockops. - Engineers MUST NOT enable `sockops.enabled: true` globally without configuring explicit `authentication.mode: required` in downstream CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy resources. - Cilium Network Policies MUST explicitly define `authentication: { mode: required }` on mutual egress/ingress rules where sockmap redirection is eligible to prevent unauthenticated TCP stream splicing. - Services MUST NEVER configure `bpf.sockops.enable=true` on workloads handling multi-tenant or regulated traffic without verifying that TLS termination or handshake validation occurs before socket mapping. - CI/CD validation pipelines MUST verify that Cilium Helm values guarantee `authentication.mutual.spire.enabled: true` or equivalent PKI integration whenever BPF socket acceleration is toggled on. ## Bad vs Good Implementations ### Cilium Network Policy & Mesh Values mTLS Handshake Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The policy omits the authentication requirement block. In environments where sockops acceleration is active, eBPF redirect routines splice TCP sockets directly via BPF maps without awaiting or verifying mutual TLS cryptographic handshakes or SPIFFE identity attestation. ```yaml # Flawed Cilium configuration: BPF sockops accelerates traffic, bypassing mTLS handshakes apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: secure-microservice-policy namespace: production spec: endpointSelector: matchLabels: app: payment-service ingress: - fromEndpoints: - matchLabels: app: frontend toPorts: - ports: - port: "8443" protocol: TCP # Missing authentication block: sockops short-circuits TCP stack # plaintext or forged traffic bypasses SPIFFE validation ``` #### Production Standard (Correct) > **Standard**: The policy explicitly declares 'authentication.mode: required' with SPIRE identity integration. Cilium eBPF programs will not commit the connection to socket-layer redirection maps until mutual identity verification and cryptographic handshake invariants are satisfied. ```yaml # Secure Cilium configuration: Enforcing strict mutual authentication before socket bypass apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: secure-microservice-policy namespace: production spec: endpointSelector: matchLabels: app: payment-service ingress: - fromEndpoints: - matchLabels: app: frontend toPorts: - ports: - port: "8443" protocol: TCP authentication: mode: required type: spire ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Socket-Layer mTLS Handshake Bypass Prevention Guardrail

Cilium eBPF Socket-Layer mTLS Handshake Bypass Prevention Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces strict ordering and cryptographic identity validation in Cilium sidecarless service mesh architectures prior to sockops socket-layer acceleration. Prevents BPF sockmap/sockhash redirects from short-circuiting TLS handshakes or routing plaintext traffic directly across endpoints without prior mutual TLS authentication verification. Ensures that any socket bypass logic verifies the SPIFFE ID and mutual authentication handshake state before executing sock_ops redirection. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Host Cryptographic Layer via Premature BPF Sockops Redirection Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Host Cryptographic Layer via Premature BPF Sockops Redirection	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure Cilium mutual authentication with an explicit validation mode (e.g., SPIRE or Cilium node-to-node mTLS) before enabling socket-layer acceleration via sockops.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.