AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
devopscritical PriorityID: cilium-spiffe-spire-ebpf-mtls-attestation

Cilium 1.16 SPIFFE/SPIRE eBPF-Accelerated Workload Identity Attestation

Mandates cryptographic zero-trust mutual authentication using Cilium 1.16 integrated with SPIRE/SPIFFE workload identity attestation. Enforces kernel-level eBPF connection orchestration with control-plane X.509 SVID validation without injecting resource-heavy sidecar proxies.

Prohibited Anti-Pattern: Unattested L3/L4 Network Policies or Legacy Sidecar Proxy Injection for Inter-Pod mTLS

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Cilium 1.16 SPIFFE/SPIRE eBPF-Accelerated Workload Identity Attestation - Mandates cryptographic zero-trust mutual authentication using Cilium 1.16 integrated with SPIRE/SPIFFE workload identity attestation. Enforces kernel-level eBPF connection orchestration with control-plane X.509 SVID validation without injecting resource-heavy sidecar proxies.
globs: **/templates/**/*.yaml, **/helm/**/*.yaml, **/crds/**/*.yaml, **/cilium/**/*.yaml, **/k8s/**/*.yaml, **/*networkpolicy*.yaml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cilium-spiffe-spire-ebpf-mtls-attestation"
---

# Cilium 1.16 SPIFFE/SPIRE eBPF-Accelerated Workload Identity Attestation

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Unattested L3/L4 Network Policies or Legacy Sidecar Proxy Injection for Inter-Pod mTLS

## System Constraints
You are a Principal Cloud-Native Security Architect and Rules Author enforcing Cilium 1.16 SPIFFE/SPIRE mTLS Cryptographic Workload Identity Attestation. You must reject sidecar proxy patterns for internal service-to-service mTLS and enforce eBPF-native node-level mutual authentication. Verify that every CiliumNetworkPolicy enforcing sensitive pod communication mandates `authentication.mode: spiffe` and that cluster deployments properly configure the SPIRE Agent socket sharing and trust domain hierarchy.

## Strict Guidelines
- Engineers MUST ALWAYS configure `authentication: mode: spiffe` in CiliumNetworkPolicy (CNP) and CiliumClusterwideNetworkPolicy (CCNP) ingress/egress rules requiring mTLS.
- Engineers MUST NOT inject Envoy/Linkerd sidecar proxies into application pods solely for transport encryption or pod-to-pod identity attestation.
- Helm deployments MUST configure Cilium 1.16 with `authentication.mutual.spiffe.enabled=true`, `authentication.mutual.spiffe.trustDomain=<domain>`, and validate host socket accessibility for `/run/spire/sockets/agent.sock`.
- SPIFFE IDs MUST strictly follow the canonical format `spiffe://<trustDomain>/ns/<namespace>/sa/<serviceAccount>` to avoid certificate SAN validation failures during node-handshake attestation.
- Services MUST retain standard TCP/HTTP application logic without in-app TLS termination or custom mTLS code when delegated to Cilium's eBPF datapath.
- Components NEVER fall back to standard label-based IP authorization without cryptographic attestation for workloads handling PCI, HIPAA, or high-security PII.

## Bad vs Good Implementations
### CiliumNetworkPolicy Mutual Authentication with SPIFFE

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Relies solely on label-based network identity (L3/L4 IP-based security identities) which lacks non-repudiable cryptographic proof of workload identity and fails zero-trust compliance standards.
```yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: secure-payment-ingress
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: payment-gateway
  ingress:
  - fromEndpoints:
    - matchLabels:
        app.kubernetes.io/name: checkout-api
    toPorts:
    - ports:
      - port: "8443"
        protocol: TCP
# CRITICAL FLAW: Policy relies exclusively on ephemeral Kubernetes pod labels
# susceptible to IP/identity spoofing without cryptographic SPIFFE SVID attestation.
```

#### Production Standard (Correct)
> **Standard**: Explicitly declares `authentication.mode: spiffe`. Cilium 1.16 intercepts the connection in the eBPF datapath, halts packet forwarding until node agents perform a mutual TLS handshake using SPIFFE X.509 SVIDs fetched via SPIRE, then resumes line-rate kernel forwarding.
```yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: secure-payment-ingress
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: payment-gateway
  ingress:
  - fromEndpoints:
    - matchLabels:
        app.kubernetes.io/name: checkout-api
    authentication:
      mode: spiffe
    toPorts:
    - ports:
      - port: "8443"
        protocol: TCP
```

### Cilium 1.16 Helm Chart SPIFFE/SPIRE Mutual Authentication Configuration

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Disabling the SPIFFE authentication subsystem prevents Cilium from performing out-of-band TLS handshakes, breaking any policy with `mode: spiffe` and reverting to non-cryptographic label filtering.
```yaml
authentication:
  mutual:
    spiffe:
      enabled: false
# CRITICAL FLAW: Mutual authentication disabled, leaving network policies to handle only basic L3/L4 identities.
```

#### Production Standard (Correct)
> **Standard**: Correctly enables Cilium 1.16 SPIFFE integration, specifies the valid trust domain, and mounts the host-level SPIRE agent Workload API UNIX domain socket so the Cilium agent daemon can fetch and validate X.509 SVIDs.
```yaml
authentication:
  mutual:
    spiffe:
      enabled: true
      trustDomain: "cluster.local"
      agentSocketPath: "/run/spire/sockets/agent.sock"
extraHostMounts:
  - name: spire-agent-socket
    mountPath: /run/spire/sockets
    hostPath: /run/spire/sockets
    readOnly: true
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector MCP
Inspects cluster state, Cilium agent DaemonSet configurations, and validating CiliumNetworkPolicy objects live on target clusters.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cilium CLI Suite
Executes cilium status, policy conformance tests, and auth validation diagnostics directly against the eBPF datapath.
SPIRE CLI Attestation Validator
Inspects SPIRE Server registrations and validates SPIFFE SVID minting for Kubernetes pods.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium 1.16 SPIFFE/SPIRE eBPF-Accelerated Workload Identity Attestation

Cilium 1.16 SPIFFE/SPIRE eBPF-Accelerated Workload Identity Attestation defines an industrial-grade behavioral standard for devops engineering. Mandates cryptographic zero-trust mutual authentication using Cilium 1.16 integrated with SPIRE/SPIFFE workload identity attestation. Enforces kernel-level eBPF connection orchestration with control-plane X.509 SVID validation without injecting resource-heavy sidecar proxies. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unattested L3/L4 Network Policies or Legacy Sidecar Proxy Injection for Inter-Pod mTLS Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftUnattested L3/L4 Network Policies or Legacy Sidecar Proxy Injection for Inter-Pod mTLSCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS configure `authentication

Engineers MUST ALWAYS configure `authentication: mode: spiffe` in CiliumNetworkPolicy (CNP) and CiliumClusterwideNetworkPolicy (CCNP) ingress/egress rules requiring mTLS.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT inject Envoy/Linkerd sidecar proxies into application pods solely for transport encryption or pod-to-pod identity attestation.

Engineers MUST NOT inject Envoy/Linkerd sidecar proxies into application pods solely for transport encryption or pod-to-pod identity attestation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Helm deployments MUST configure Cilium 1.16 with `authentication.mutual.spiffe.enabled=true`, `authentication.mutual.spiffe.trustDomain=<domain>`, and validate host socket accessibility for `/run/spire/sockets/agent.sock`.

Helm deployments MUST configure Cilium 1.16 with `authentication.mutual.spiffe.enabled=true`, `authentication.mutual.spiffe.trustDomain=<domain>`, and validate host socket accessibility for `/run/spire/sockets/agent.sock`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

SPIFFE IDs MUST strictly follow the canonical format `spiffe

SPIFFE IDs MUST strictly follow the canonical format `spiffe://<trustDomain>/ns/<namespace>/sa/<serviceAccount>` to avoid certificate SAN validation failures during node-handshake attestation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Services MUST retain standard TCP/HTTP application logic without in-app TLS termination or custom mTLS code when delegated to Cilium's eBPF datapath.

Services MUST retain standard TCP/HTTP application logic without in-app TLS termination or custom mTLS code when delegated to Cilium's eBPF datapath.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Components NEVER fall back to standard label-based IP authorization without cryptographic attestation for workloads handling PCI, HIPAA, or high-security PII.

Components NEVER fall back to standard label-based IP authorization without cryptographic attestation for workloads handling PCI, HIPAA, or high-security PII.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Cilium 1.16 SPIFFE/SPIRE eBPF-Accelerated Workload Identity Attestation critical for AI coding assistants?

Mandates cryptographic zero-trust mutual authentication using Cilium 1.16 integrated with SPIRE/SPIFFE workload identity attestation. Enforces kernel-level eBPF connection orchestration with control-plane X.509 SVID validation without injecting resource-heavy sidecar proxies. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unattested L3/L4 Network Policies or Legacy Sidecar Proxy Injection for Inter-Pod mTLS) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →
devops
86

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

devops
118

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

devops
40

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

Cilium