AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
devopscritical PriorityID: cilium-sockops-l7-bypass-prevention-standard

Cilium eBPF Sockops L7 Envoy Bypass Prevention Standard

Enforces architectural guarantees that eBPF socket-layer acceleration (sockops/sockmap) does not short-circuit node-local TCP connections past Cilium's L7 Envoy proxy. Prevents silent security bypasses of Layer 7 policy evaluation, mTLS validation, and HTTP/gRPC inspection caused by premature kernel-level socket redirection.

Prohibited Anti-Pattern: Enabling eBPF Sockops Without L7 Envoy Redirection Isolation, Skipping Layer 7 Network Policies and mTLS

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Cilium eBPF Sockops L7 Envoy Bypass Prevention Standard - Enforces architectural guarantees that eBPF socket-layer acceleration (sockops/sockmap) does not short-circuit node-local TCP connections past Cilium's L7 Envoy proxy. Prevents silent security bypasses of Layer 7 policy evaluation, mTLS validation, and HTTP/gRPC inspection caused by premature kernel-level socket redirection.
globs: helm/**/*.yaml, charts/**/*.yaml, k8s/**/*.yaml, deploy/**/*.yaml, infrastructure/**/*.tf
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cilium-sockops-l7-bypass-prevention-standard"
---

# Cilium eBPF Sockops L7 Envoy Bypass Prevention Standard

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Enabling eBPF Sockops Without L7 Envoy Redirection Isolation, Skipping Layer 7 Network Policies and mTLS

## System Constraints
You are a Principal Software Architect enforcing the Cilium eBPF Sockops L7 Envoy Bypass Prevention Standard. eBPF socket-layer acceleration (sockops/sockmap via BPF_PROG_TYPE_SOCK_OPS and BPF_MAP_TYPE_SOCKHASH) short-circuits TCP data paths directly between peer sockets on the same node. You must ensure that any node-local socket acceleration strictly defers to Cilium's user-space Envoy proxy whenever Layer 7 inspection (HTTP, gRPC, Kafka) or CiliumNetworkPolicy L7 rules are declared. Flag any configuration where sockops is enabled globally without strict L7 policy gating or proxy redirection guards.

## Strict Guidelines
- Engineers MUST disable global eBPF sockops (`sockops.enabled: false`) when running clusters requiring strict Cilium Layer 7 policy enforcement (HTTP/gRPC filtering or mTLS) unless Cilium is explicitly configured to bypass sockmap for proxy-redirected endpoints.
- Engineers MUST NOT allow `bpf-sockops` to directly populate sockmaps (`BPF_MAP_TYPE_SOCKHASH`) for traffic targeting pods with active `CiliumNetworkPolicy` or `CiliumClusterwideNetworkPolicy` containing `toPorts.rules`.
- Helm charts for Cilium MUST configure `proxy.prometheus.enabled: true` and monitor `cilium_proxy_redirect_total` vs `cilium_bpf_sockops_redirects_total` to detect anomalous policy-bypassing flows.
- CiliumNetworkPolicy manifests MUST explicitly declare L7 rules using the Envoy proxy parser (`rules.http` or `rules.l7`) alongside port declarations to guarantee the kernel assigns an L7 proxy port instead of executing sockops shortcutting.
- DevOps pipelines MUST validate Cilium Helm values to reject `sockops.enabled: true` in environments where `kube-proxy-replacement: strict` and Istio/Cilium Service Mesh mTLS termination co-exist without proxy socket-awareness.

## Bad vs Good Implementations
### Cilium Helm Configuration and CiliumNetworkPolicy L7 Enforcement

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Enabling `sockops.enabled: true` allows the BPF program `bpf_sockops` to hook TCP connection events and install peer socket redirects via `bpf_msg_verdict` into a `SOCKHASH`. When client and server reside on the same node, traffic flows directly across socket buffers in the kernel, bypassing Envoy L7 filters and inspection.
```yaml
# INSECURE: Enabling sockops globally while enforcing L7 policies
# Cilium's bpf_sockops program binds node-local peer sockets directly,
# short-circuiting local TCP traffic and bypassing the Envoy proxy and mTLS checks.
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: cilium
  namespace: kube-system
spec:
  values:
    kubeProxyReplacement: true
    sockops:
      enabled: true # VULNERABLE: Bypasses Envoy proxy for same-node pods
    l7Proxy: true
---
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-internal-api
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: internal-api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          # Policy author expects L7 inspection, but rules are missing
          # and sockops shortcuts the socket connection past Envoy entirely.
```

#### Production Standard (Correct)
> **Standard**: Disabling `sockops.enabled` guarantees that all ingress and egress packets flow through standard Cilium tc (traffic control) filters. When L7 rules are explicitly defined under `rules.http`, Cilium redirects matching traffic to the internal Envoy proxy, enforcing zero-trust HTTP path validation and mTLS checks.
```yaml
# SECURE: Sockops disabled or strictly gated, L7 rules explicitly registered with Envoy
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: cilium
  namespace: kube-system
spec:
  values:
    kubeProxyReplacement: true
    # Disable sockops in clusters with active L7 inspection to guarantee Envoy mediation
    sockops:
      enabled: false
    l7Proxy: true
    bpf:
      preallocateMaps: true
    envoy:
      enabled: true
---
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-internal-api
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: internal-api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"
                path: "/api/v1/health"
              - method: "POST"
                path: "/api/v1/data"
                headers:
                  - 'X-Validated-Client: true'
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector MCP
Inspects live Kubernetes Cilium ConfigMaps, CiliumNetworkPolicies, and daemonset configurations to verify proxy and sockops flags.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cilium CLI Diagnosis Suite
Executes 'cilium bpf socklist dump' and 'cilium endpoint list' to verify that proxy redirection is active and sockmap redirects are disabled for L7-managed pods.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Sockops L7 Envoy Bypass Prevention Standard

Cilium eBPF Sockops L7 Envoy Bypass Prevention Standard defines an industrial-grade behavioral standard for devops engineering. Enforces architectural guarantees that eBPF socket-layer acceleration (sockops/sockmap) does not short-circuit node-local TCP connections past Cilium's L7 Envoy proxy. Prevents silent security bypasses of Layer 7 policy evaluation, mTLS validation, and HTTP/gRPC inspection caused by premature kernel-level socket redirection. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Enabling eBPF Sockops Without L7 Envoy Redirection Isolation, Skipping Layer 7 Network Policies and mTLS Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftEnabling eBPF Sockops Without L7 Envoy Redirection Isolation, Skipping Layer 7 Network Policies and mTLSCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST disable global eBPF sockops (`sockops.enabled

Engineers MUST disable global eBPF sockops (`sockops.enabled: false`) when running clusters requiring strict Cilium Layer 7 policy enforcement (HTTP/gRPC filtering or mTLS) unless Cilium is explicitly configured to bypass sockmap for proxy-redirected endpoints.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT allow `bpf-sockops` to directly populate sockmaps (`BPF_MAP_TYPE_SOCKHASH`) for traffic targeting pods with active `CiliumNetworkPolicy` or `CiliumClusterwideNetworkPolicy` containing `toPorts.rules`.

Engineers MUST NOT allow `bpf-sockops` to directly populate sockmaps (`BPF_MAP_TYPE_SOCKHASH`) for traffic targeting pods with active `CiliumNetworkPolicy` or `CiliumClusterwideNetworkPolicy` containing `toPorts.rules`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Helm charts for Cilium MUST configure `proxy.prometheus.enabled

Helm charts for Cilium MUST configure `proxy.prometheus.enabled: true` and monitor `cilium_proxy_redirect_total` vs `cilium_bpf_sockops_redirects_total` to detect anomalous policy-bypassing flows.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

CiliumNetworkPolicy manifests MUST explicitly declare L7 rules using the Envoy proxy parser (`rules.http` or `rules.l7`) alongside port declarations to guarantee the kernel assigns an L7 proxy port instead of executing sockops shortcutting.

CiliumNetworkPolicy manifests MUST explicitly declare L7 rules using the Envoy proxy parser (`rules.http` or `rules.l7`) alongside port declarations to guarantee the kernel assigns an L7 proxy port instead of executing sockops shortcutting.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

DevOps pipelines MUST validate Cilium Helm values to reject `sockops.enabled

DevOps pipelines MUST validate Cilium Helm values to reject `sockops.enabled: true` in environments where `kube-proxy-replacement: strict` and Istio/Cilium Service Mesh mTLS termination co-exist without proxy socket-awareness.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Cilium eBPF Sockops L7 Envoy Bypass Prevention Standard critical for AI coding assistants?

Enforces architectural guarantees that eBPF socket-layer acceleration (sockops/sockmap) does not short-circuit node-local TCP connections past Cilium's L7 Envoy proxy. Prevents silent security bypasses of Layer 7 policy evaluation, mTLS validation, and HTTP/gRPC inspection caused by premature kernel-level socket redirection. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Enabling eBPF Sockops Without L7 Envoy Redirection Isolation, Skipping Layer 7 Network Policies and mTLS) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →
devops
86

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

devops
118

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

devops
40

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

Cilium