eBPF Sidecarless Service Mesh L7 mTLS & Kernel Flow Standard

--- description: eBPF Sidecarless Service Mesh L7 mTLS & Kernel Flow Standard - Enforces cryptographic zero-trust verification and deterministic L7 proxy steering within sidecarless eBPF mesh datapaths. Guarantees that kernel-level socket short-circuits (sockmap/sockops) do not bypass mutual TLS authentication, SPIFFE identity attestation, or Layer 7 inspection filters. globs: **/*.yaml, **/*.yml, deployments/**/*.{yaml,yml}, k8s/**/*.{yaml,yml}, pkg/datapath/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-sidecarless-mesh-mtls-kernel-flow" --- # eBPF Sidecarless Service Mesh L7 mTLS & Kernel Flow Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing mTLS handshakes and L7 policy enforcement via unauthenticated eBPF socket-to-socket short-circuiting ## System Constraints You are a Principal DevOps and Systems Architect enforcing the eBPF Sidecarless Service Mesh L7 mTLS & Kernel Flow Standard. You must ensure that sidecarless architectures utilizing eBPF sockmap redirection, sockops, and node-local proxies (e.g., Cilium Service Mesh, Istio Ambient) never trade zero-trust security guarantees for kernel datapath acceleration. Always enforce strict mTLS peer authentication, deterministic L7 proxy handoffs, and cryptographically verified network policies. ## Strict Guidelines - Engineers MUST ALWAYS enforce strict mutual TLS (mTLS) with SPIFFE identity verification before allowing socket redirection or payload acceleration across pods. - Engineers MUST NOT allow eBPF sockmap/sockhash programs (`BPF_MAP_TYPE_SOCKMAP`) to splice TCP streams directly between pods without verifying that an authenticated session (or kTLS context) has been fully negotiated. - Services requiring Layer 7 policies (path routing, header manipulation, rate limiting, JWT validation) MUST be explicitly directed to node-local proxy daemons (e.g., Envoy ztunnel/waypoint) rather than remaining purely in the eBPF L4 fast path. - Code and manifests MUST explicitly reject 'PERMISSIVE' authentication modes in production; mesh peer authentication MUST be declared as 'STRICT'. - Network policies MUST NOT configure unencrypted fallback routes on kernel lookup failure; all unauthenticated or unroutable flows MUST fail closed (drop packet). ## Bad vs Good Implementations ### Configuring Sidecarless eBPF Mesh with Strict mTLS and Layer 7 Ingress Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring PERMISSIVE mTLS and bare L4 ingress policies allows eBPF sockmap programs to redirect unencrypted TCP sockets directly between network namespaces without validating SPIFFE crypt identities or proxying Layer 7 calls through an inspection engine. ```yaml # Insecure: Permissive mTLS with raw sockops bypass and no L7 enforcement apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: secure-payment-service namespace: payments spec: endpointSelector: matchLabels: app: payment-gateway ingress: - fromEndpoints: - matchLabels: app: order-processor # Flaw: No mTLS verification; allows unauthenticated L4 sockmap splice --- apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: default namespace: payments spec: # Flaw: Permissive allows plaintext kernel traffic bypass mtls: mode: PERMISSIVE ``` #### Production Standard (Correct) > **Standard**: The policy requires mutual TLS authentication explicitly (`mode: required` / `mode: STRICT`) and routes traffic through Layer 7 policy enforcement (HTTP POST restriction), preventing premature eBPF sockops short-circuiting before authentication and inspection. ```yaml # Secure: Strict mTLS attestation and deterministic L7 node-proxy redirection apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: secure-payment-service namespace: payments spec: endpointSelector: matchLabels: app: payment-gateway ingress: - fromEndpoints: - matchLabels: app: order-processor authentication: mode: required # Mandates mutual TLS via node-level Envoy / SPIRE toPorts: - ports: - port: "8443" protocol: TCP rules: http: - method: POST path: "/v1/charge" --- apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: default namespace: payments spec: # Invariant: Must fail closed with STRICT mTLS mtls: mode: STRICT ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Sidecarless Service Mesh L7 mTLS & Kernel Flow Standard

eBPF Sidecarless Service Mesh L7 mTLS & Kernel Flow Standard defines an industrial-grade behavioral standard for devops engineering. Enforces cryptographic zero-trust verification and deterministic L7 proxy steering within sidecarless eBPF mesh datapaths. Guarantees that kernel-level socket short-circuits (sockmap/sockops) do not bypass mutual TLS authentication, SPIFFE identity attestation, or Layer 7 inspection filters. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing mTLS handshakes and L7 policy enforcement via unauthenticated eBPF socket-to-socket short-circuiting Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing mTLS handshakes and L7 policy enforcement via unauthenticated eBPF socket-to-socket short-circuiting	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce strict mutual TLS (mTLS) with SPIFFE identity verification before allowing socket redirection or payload acceleration across pods.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.