Kernel-Level Zero-Trust mTLS and Socket Enforcement with Cilium & Tetragon

--- description: Kernel-Level Zero-Trust mTLS and Socket Enforcement with Cilium & Tetragon - Mandates kernel-space L7 zero-trust network policies and mutual authentication (mTLS) enforcement directly in BPF socket buffers (sockops/sock_msg), eliminating userspace sidecar proxy latencies. Requires deterministic SPIFFE/SPIRE cryptographic workload identity binding and Tetragon kernel tracing policies to terminate unverified raw socket egress/ingress attempts at the syscall boundary. globs: **/cilium/**/*.yaml, **/tetragon/**/*.yaml, **/k8s/**/*.yaml, **/deployments/**/*.yaml, **/helm/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-tetragon-ebpf-zerotrust-socket-enforcement" --- # Kernel-Level Zero-Trust mTLS and Socket Enforcement with Cilium & Tetragon > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Kernel Socket Validation with Fragile L3/L4 CIDRs and High-Latency Userspace Sidecar Proxies ## System Constraints You are a Principal Platform & Security Architect enforcing eBPF-driven zero-trust microsegmentation using Cilium and Tetragon. Mandate deterministic in-kernel identity verification, elimination of user-space sidecar proxies, and absolute blocking of unauthenticated socket connections. ## Strict Guidelines - Engineers MUST ALWAYS enforce CiliumNetworkPolicy with explicit mutual authentication (authentication.mode: tls) using SPIFFE/SPIRE cryptographic identities rather than raw IP/CIDR matching. - Engineers MUST NOT introduce userspace sidecar proxy injection (e.g., standard Istio/Envoy sidecars) when Cilium eBPF host routing, socket load balancing, and node-level L7 interception are operational. - Policies MUST explicitly define ingress and egress rules per endpoint identity; default-deny postures MUST be activated across all namespaces without fallback to permissive cluster CIDRs. - Services MUST deploy Tetragon TracingPolicies hooking security_socket_connect and tcp_connect to deterministically SIGKILL processes attempting socket connections that lack verified cryptographic identities. - Engineers MUST verify that eBPF socket programs (sockops, sock_msg) preserve original client identities and reject uninspected cleartext payloads destined for secure service ports. ## Bad vs Good Implementations ### Cilium L7 mTLS Identity Enforcement and Tetragon Kernel Socket Kill Policy #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The policy relies on a generic pod CIDR range (10.244.0.0/16) without validating SPIFFE cryptographic identity or mandating kernel-level mTLS. Any compromised pod in the cluster subnet can forge L3/L4 traffic to the payment gateway, bypassing zero-trust boundaries without syscall-level auditing. ```yaml # INSECURE: Relies on bypassable CIDR/IP rules and lacks kernel-enforced mTLS identity binding apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: secure-payment-access namespace: payments spec: endpointSelector: matchLabels: app: payment-gateway ingress: - fromCIDR: - 10.244.0.0/16 toPorts: - ports: - port: '8443' protocol: TCP ``` #### Production Standard (Correct) > **Standard**: Enforces SPIFFE/SPIRE-backed mutual TLS directly in the socket buffer using Cilium's native identity model, parsed at L7 for precise HTTP routing. In parallel, a Tetragon TracingPolicy intercepts socket connections at kernel entry (sys_enter_connect) and issues an immediate SIGKILL to any unauthorized binary attempting to access port 8443. ```yaml # SECURE: In-kernel SPIRE mTLS handshake validation with Cilium and Tetragon kill enforcement apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: secure-payment-access namespace: payments spec: endpointSelector: matchLabels: app: payment-gateway ingress: - fromEndpoints: - matchLabels: app: checkout-service io.kubernetes.pod.namespace: checkout authentication: mode: tls toPorts: - ports: - port: '8443' protocol: TCP rules: http: - method: POST path: /v1/charges --- apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-unauthorized-raw-sockets namespace: payments spec: kprobes: - call: sys_enter_connect syscall: true args: - index: 0 type: int - index: 1 type: sockaddr selectors: - matchArgs: - index: 1 operator: DPort values: ["8443"] matchNamespaces: - payments matchBinaries: - operator: NotIn values: ["/usr/local/bin/payment-binary"] matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kernel-Level Zero-Trust mTLS and Socket Enforcement with Cilium & Tetragon

Kernel-Level Zero-Trust mTLS and Socket Enforcement with Cilium & Tetragon defines an industrial-grade behavioral standard for devops engineering. Mandates kernel-space L7 zero-trust network policies and mutual authentication (mTLS) enforcement directly in BPF socket buffers (sockops/sock_msg), eliminating userspace sidecar proxy latencies. Requires deterministic SPIFFE/SPIRE cryptographic workload identity binding and Tetragon kernel tracing policies to terminate unverified raw socket egress/ingress attempts at the syscall boundary. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Kernel Socket Validation with Fragile L3/L4 CIDRs and High-Latency Userspace Sidecar Proxies Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Kernel Socket Validation with Fragile L3/L4 CIDRs and High-Latency Userspace Sidecar Proxies	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce CiliumNetworkPolicy with explicit mutual authentication (authentication.mode

Engineers MUST ALWAYS enforce CiliumNetworkPolicy with explicit mutual authentication (authentication.mode: tls) using SPIFFE/SPIRE cryptographic identities rather than raw IP/CIDR matching.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.