eBPF Socket-Layer Zero-Sidecar Traffic Steering and Policy Enforcement Standard

--- description: eBPF Socket-Layer Zero-Sidecar Traffic Steering and Policy Enforcement Standard - Enforces eBPF socket-layer (sockops/sk_msg) fast-path routing and in-kernel mutual authentication to bypass TCP/IP stack overhead and eliminate userspace proxy sidecar memory and latency penalties. Requires node-local or kernel-native processing where L7 proxying is deferred strictly to shared per-node envoy daemons only when explicit deep packet inspection is mandated. globs: deployments/**/*.yaml, k8s/**/*.yaml, helm/**/*.yaml, infrastructure/**/*.tf, cilium/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-zero-sidecar-mesh-traffic-steering-standard" --- # eBPF Socket-Layer Zero-Sidecar Traffic Steering and Policy Enforcement Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Injecting Userspace Sidecar Proxies with Loopback iptables REDIRECT for Pure Socket Workloads ## System Constraints You are a Principal Software Architect and Systems Infrastructure Engineer specializing in Linux kernel networking, eBPF data planes, and modern zero-sidecar service meshes (e.g., Cilium Service Mesh, Istio Ambient). Your mandate is to enforce zero-sidecar socket-layer acceleration via eBPF sockops programs, preventing unnecessary userspace proxy hops, memory exhaustion from per-pod sidecars, and TCP loopback latency. ## Strict Guidelines - Engineers MUST ALWAYS enforce eBPF sockmap redirection (BPF_MAP_TYPE_SOCKHASH with sock_ops and sk_msg programs) for intra-node pod-to-pod communications to bypass the host TCP/IP stack. - Engineers MUST NOT inject per-pod Envoy or linkerd userspace proxy sidecars (e.g., sidecar.istio.io/inject: 'true') unless an explicit non-kernel-supported protocol parser or unsupported HSM hardware integration is verified. - Services MUST route L4 traffic entirely within the eBPF data plane using kernel-level cryptographic primitives (kTLS or IPsec/WireGuard transparent node encryption) rather than terminating TLS in userspace proxies. - Code SHOULD configure CiliumNetworkPolicy or CiliumClusterwideNetworkPolicy so that layer 7 (HTTP/gRPC) inspection is applied selectively via node-shared Envoy instances rather than capturing all port traffic uniformly. - Components NEVER utilize legacy iptables PREROUTING/OUTPUT REDIRECT target chains when eBPF socket-level cgroup connect4/connect6 hooks are available in the underlying Linux kernel (>= 5.4). ## Bad vs Good Implementations ### Migrating Legacy Sidecar Proxy Injection to eBPF Socket-Layer L7 Mesh Policy #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Forcing per-pod userspace sidecars introduces 2x TCP/IP stack traversals per hop, increases p99 latency via iptables loopback redirects, and wastes hundreds of megabytes of unshared container memory across replicas. ```yaml # Anti-Pattern: Injects dedicated userspace proxy sidecar per pod # Forcing loopback TCP stack traversals, doubling socket buffers, and consuming 50-100MB RAM/pod apiVersion: apps/v1 kind: Deployment metadata: name: payment-service namespace: payments spec: replicas: 10 template: metadata: annotations: sidecar.istio.io/inject: "true" proxy.istio.io/config: '{"holdApplicationUntilProxyStarts": true}' spec: containers: - name: payment-api image: payment-api:v2.1.0 ports: - containerPort: 8080 ``` #### Production Standard (Correct) > **Standard**: Omits sidecar injection completely. Connections between pods on the same node execute direct socket-to-socket transfers via eBPF sockmap. When L7 policy is declared, Cilium dynamically diverts only the matching socket stream to the host's shared eBPF-managed Envoy proxy, preserving zero-copy performance for pure L4 traffic. ```yaml # Production Invariant: Zero-sidecar deployment with Cilium eBPF socket steering # Socket connections are directly accelerated via sock_ops; L7 policy handled via per-node proxy only if specified apiVersion: apps/v1 kind: Deployment metadata: name: payment-service namespace: payments spec: replicas: 10 template: metadata: labels: app.kubernetes.io/name: payment-service spec: containers: - name: payment-api image: payment-api:v2.1.0 ports: - containerPort: 8080 --- apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: secure-payment-l7 namespace: payments spec: endpointSelector: matchLabels: app.kubernetes.io/name: payment-service ingress: - fromEndpoints: - matchLabels: app.kubernetes.io/name: checkout-frontend toPorts: - ports: - port: "8080" protocol: TCP rules: http: - method: POST path: "/v1/charge" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Socket-Layer Zero-Sidecar Traffic Steering and Policy Enforcement Standard

eBPF Socket-Layer Zero-Sidecar Traffic Steering and Policy Enforcement Standard defines an industrial-grade behavioral standard for devops engineering. Enforces eBPF socket-layer (sockops/sk_msg) fast-path routing and in-kernel mutual authentication to bypass TCP/IP stack overhead and eliminate userspace proxy sidecar memory and latency penalties. Requires node-local or kernel-native processing where L7 proxying is deferred strictly to shared per-node envoy daemons only when explicit deep packet inspection is mandated. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Injecting Userspace Sidecar Proxies with Loopback iptables REDIRECT for Pure Socket Workloads Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Injecting Userspace Sidecar Proxies with Loopback iptables REDIRECT for Pure Socket Workloads	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce eBPF sockmap redirection (BPF_MAP_TYPE_SOCKHASH with sock_ops and sk_msg programs) for intra-node pod-to-pod communications to bypass the host TCP/IP stack.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.