AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: cilium-ebpf-sockops-zero-trust-identity-standard

Cilium eBPF Socket-Layer Acceleration & Cryptographic Mutual Identity Guardrail

Enforces strict cryptographic pod-to-pod identity authentication via Cilium Network Policies decoupled from data-path forwarding, utilizing Linux eBPF sockops programs for socket-level short-circuiting. Eliminates unauthenticated label-only trust models and sidecar proxy CPU/latency overhead by mandating control-plane mutual handshake validation with socket-layer kernel redirection.

Prohibited Anti-Pattern: Relying on Unauthenticated IP/Label Whitelisting and User-Space Sidecar Proxies Instead of In-Kernel Socket Acceleration and Mutual Identity Verification

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Cilium eBPF Socket-Layer Acceleration & Cryptographic Mutual Identity Guardrail - Enforces strict cryptographic pod-to-pod identity authentication via Cilium Network Policies decoupled from data-path forwarding, utilizing Linux eBPF sockops programs for socket-level short-circuiting. Eliminates unauthenticated label-only trust models and sidecar proxy CPU/latency overhead by mandating control-plane mutual handshake validation with socket-layer kernel redirection.
globs: k8s/**/*.yaml, infra/**/*.yaml, deploy/**/*.yaml, helm/**/*.yaml, cilium/**/*.yaml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cilium-ebpf-sockops-zero-trust-identity-standard"
---

# Cilium eBPF Socket-Layer Acceleration & Cryptographic Mutual Identity Guardrail

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Relying on Unauthenticated IP/Label Whitelisting and User-Space Sidecar Proxies Instead of In-Kernel Socket Acceleration and Mutual Identity Verification

## System Constraints
You are a Principal Infrastructure & Security Architect enforcing the Cilium eBPF Socket-Layer Acceleration Zero-Trust Identity Standard. You must ensure all pod-to-pod communication enforces cryptographic mutual identity verification while leveraging Cilium eBPF sockops for kernel-level acceleration. Strictly reject legacy sidecar-based mTLS architectures and unverified IP/label-only CiliumNetworkPolicy definitions.

## Strict Guidelines
- Engineers MUST ALWAYS enforce cryptographic mutual authentication in `CiliumNetworkPolicy` using `authentication.mode: test-always-fail` (in staging) or `authentication.mode: mutual` backed by a SPIFFE/SPIRE certificate provider.
- Engineers MUST NOT rely solely on Kubernetes pod labels or IP-based L3/L4 rules for trust boundaries, as labels do not provide cryptographic non-repudiation.
- Services MUST enable Linux `sockops` acceleration (`sockops.enabled: true` and `bpf.sockops.enable: true` in Cilium Helm values) to bypass TCP/IP stack overhead for co-located pod-to-pod workloads via BPF sockmap (`BPF_MAP_TYPE_SOCKHASH`).
- Components NEVER route inter-pod communication through user-space sidecar proxies (e.g., Istio Envoy sidecars) for mTLS when Cilium eBPF socket acceleration and mutual authentication are available.
- Network policies MUST explicitly define non-empty `toEndpoints` selectors coupled with `authentication` blocks; broad wildcard CIDR matching without explicit identity attestation is strictly forbidden.

## Bad vs Good Implementations
### CiliumNetworkPolicy Identity Enforcement

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: This policy relies entirely on Kubernetes pod metadata (labels) for authorization. It does not mandate cryptographic handshake verification (mTLS via SPIFFE/SPIRE) and permits cleartext data paths without Cilium control-plane mutual authentication.
```yaml
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-payment-ingress
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app: payment-processor
  ingress:
  - fromEndpoints:
    - matchLabels:
        # SECURITY FLAW: Relies purely on spoofable/mutable pod labels
        # without cryptographic mutual authentication or sockops optimization
        app: checkout-service
    toPorts:
    - ports:
      - port: "8443"
        protocol: TCP
```

#### Production Standard (Correct)
> **Standard**: Enforces `authentication.mode: mutual`. Cilium ensures a verified cryptographic mutual handshake occurs before data packets are authorized, allowing eBPF sockops to short-circuit the socket buffers directly in the kernel without proxy latency.
```yaml
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-payment-ingress
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app: payment-processor
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: checkout-service
        io.kubernetes.pod.namespace: checkout
    # INVARIANT: Mandates cryptographic mutual authentication handshake
    # Handshake is decoupled from datapath; traffic is accelerated via eBPF sockops
    authentication:
      mode: mutual
    toPorts:
    - ports:
      - port: "8443"
        protocol: TCP
```

### Cilium Helm Configuration for Socket Acceleration and Mutual Auth

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Disabling SPIRE mutual authentication and kernel sockops eliminates zero-trust cryptographic guarantees and increases node CPU consumption and latency by routing through standard IP stack paths.
```yaml
# Cilium Helm Values with acceleration and auth disabled
authentication:
  mutual:
    spire:
      enabled: false
sockops:
  enabled: false
bpf:
  autoMount:
    bpffs: true
# FLAW: Forces network stack through full TCP/IP traversal without zero-trust auth
```

#### Production Standard (Correct)
> **Standard**: Activates Cilium's mutual authentication integration with SPIRE and enables `sockops` to allow socket-to-socket redirection via `BPF_PROG_TYPE_SOCK_OPS` and `BPF_MAP_TYPE_SOCKHASH`, maintaining high-throughput zero-trust security.
```yaml
# Cilium Helm Values with sockops acceleration and SPIFFE/SPIRE identity
authentication:
  mutual:
    spire:
      enabled: true
      adminSocketPath: /run/spire/sockets/admin.sock
sockops:
  enabled: true
bpf:
  autoMount:
    bpffs: true
  masquerade: true
# INVARIANT: eBPF sock_ops short-circuits TCP sockets while SPIRE provides cryptographic identity
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes MCP Server
Inspects running CiliumNetworkPolicies, Cilium endpoints, and cluster pods to verify mutual authentication states.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cilium CLI
CLI tool for validating Cilium status, inspecting eBPF maps, bpf-sockops state, and mutual authentication status.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Socket-Layer Acceleration & Cryptographic Mutual Identity Guardrail

Cilium eBPF Socket-Layer Acceleration & Cryptographic Mutual Identity Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces strict cryptographic pod-to-pod identity authentication via Cilium Network Policies decoupled from data-path forwarding, utilizing Linux eBPF sockops programs for socket-level short-circuiting. Eliminates unauthenticated label-only trust models and sidecar proxy CPU/latency overhead by mandating control-plane mutual handshake validation with socket-layer kernel redirection. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Unauthenticated IP/Label Whitelisting and User-Space Sidecar Proxies Instead of In-Kernel Socket Acceleration and Mutual Identity Verification Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftRelying on Unauthenticated IP/Label Whitelisting and User-Space Sidecar Proxies Instead of In-Kernel Socket Acceleration and Mutual Identity VerificationCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS enforce cryptographic mutual authentication in `CiliumNetworkPolicy` using `authentication.mode

Engineers MUST ALWAYS enforce cryptographic mutual authentication in `CiliumNetworkPolicy` using `authentication.mode: test-always-fail` (in staging) or `authentication.mode: mutual` backed by a SPIFFE/SPIRE certificate provider.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT rely solely on Kubernetes pod labels or IP-based L3/L4 rules for trust boundaries, as labels do not provide cryptographic non-repudiation.

Engineers MUST NOT rely solely on Kubernetes pod labels or IP-based L3/L4 rules for trust boundaries, as labels do not provide cryptographic non-repudiation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Services MUST enable Linux `sockops` acceleration (`sockops.enabled

Services MUST enable Linux `sockops` acceleration (`sockops.enabled: true` and `bpf.sockops.enable: true` in Cilium Helm values) to bypass TCP/IP stack overhead for co-located pod-to-pod workloads via BPF sockmap (`BPF_MAP_TYPE_SOCKHASH`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Components NEVER route inter-pod communication through user-space sidecar proxies (e.g., Istio Envoy sidecars) for mTLS when Cilium eBPF socket acceleration and mutual authentication are available.

Components NEVER route inter-pod communication through user-space sidecar proxies (e.g., Istio Envoy sidecars) for mTLS when Cilium eBPF socket acceleration and mutual authentication are available.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Network policies MUST explicitly define non-empty `toEndpoints` selectors coupled with `authentication` blocks

Network policies MUST explicitly define non-empty `toEndpoints` selectors coupled with `authentication` blocks; broad wildcard CIDR matching without explicit identity attestation is strictly forbidden.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Cilium eBPF Socket-Layer Acceleration & Cryptographic Mutual Identity Guardrail critical for AI coding assistants?

Enforces strict cryptographic pod-to-pod identity authentication via Cilium Network Policies decoupled from data-path forwarding, utilizing Linux eBPF sockops programs for socket-level short-circuiting. Eliminates unauthenticated label-only trust models and sidecar proxy CPU/latency overhead by mandating control-plane mutual handshake validation with socket-layer kernel redirection. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Relying on Unauthenticated IP/Label Whitelisting and User-Space Sidecar Proxies Instead of In-Kernel Socket Acceleration and Mutual Identity Verification) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Cilium