Open-Source Observability · cilium

cilium

Cilium is an eBPF-based networking, security, and observability platform for Kubernetes that replaces kube-proxy and provides identity-based network policies, distributed load balancing, and multi-cluster connectivity. It operates at the Linux kernel level for high performance and scales efficiently across large deployments.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/cilium/cilium

24.7k

GitHub stars

3.9k

Forks

Primary language

Apache-2.0

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	cilium/cilium
Owner	cilium
Primary language	Go
License	Apache-2.0 — OSI-approved
Stars	24.7k
Forks	3.9k
Open issues	1k
Latest release	v1.19.5 (2026-06-16)
Last updated	2026-07-08
Source	https://github.com/cilium/cilium

What cilium is

Cilium uses eBPF bytecode injected into the Linux kernel to implement Layer 3–L7 networking, security policies decoupled from IP addressing, and distributed load balancing via efficient hash tables. It supports overlay (VXLAN, Geneve) and native routing modes, XDP for north-south LB, and cluster mesh for multi-cluster orchestration.

Quickstart

Get the cilium source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/cilium/cilium.git2cd cilium3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Large-scale Kubernetes clusters with strict network security requirements

Cilium's identity-based security model and eBPF implementation enable fine-grained L3–L7 policy enforcement at wire speed without per-packet overhead, making it ideal for clusters needing compliance-grade segmentation and visibility.

Multi-cluster Kubernetes deployments requiring unified security posture

Cluster Mesh provides consistent identity-based policies, global service discovery, and seamless failover across clusters, suitable for hybrid or multi-cloud topologies where unified policy control is non-negotiable.

High-performance service meshes and load balancing at scale

Cilium's eBPF-based distributed load balancing replaces kube-proxy efficiently, supports XDP for high-throughput north-south traffic, and integrates advanced features like DSR and Maglev hashing for service-dense environments.

Implementation considerations

Kernel version and eBPF feature support must be validated pre-deployment; unsupported kernel versions or CPU/NIC combinations can degrade performance or cause policy enforcement failures.
eBPF program compilation and loading at runtime requires sufficient system resources (memory, CPU) on each node; monitor during initial rollout to detect bottlenecks.
Identity-based policy model is powerful but requires understanding Cilium's identity assignment (labels, service accounts) to avoid accidental allow-all or deny-all configurations.
Overlay vs. native routing choice depends on existing infrastructure; native routing demands routable pods and BGP/L2 setup, while overlay trades flexibility for simplicity.
Migration from kube-proxy or other CNI plugins involves testing failover behavior, monitoring for packet loss during policy transitions, and coordinating with security/network teams.

When to avoid it — and what to weigh

Using older Linux kernels without eBPF support — Cilium requires Linux kernel 4.19+ with eBPF capabilities. Environments on older kernels or non-Linux hosts (Windows, macOS) cannot run Cilium.
Minimal operational overhead or learning curve is critical — Cilium adds complexity—kernel-level debugging, eBPF bytecode familiarity, and multi-faceted configuration (CNI, load balancer, policies) require deeper Linux expertise than simpler CNI plugins.
Air-gapped or highly restricted environments with limited container registry access — Cilium distributes large OCI images (SBOM, multi-arch builds) and requires active kernel module compilation or pre-built eBPF programs; restricted registries or offline deployments may complicate adoption.
Applications requiring guaranteed Windows or non-eBPF-compatible runtimes — Cilium is Linux/eBPF-only. Heterogeneous clusters mixing Windows nodes or non-eBPF container runtimes cannot uniformly enforce Cilium policies.

License & commercial use

Cilium is licensed under Apache License 2.0, a permissive OSI-approved license permitting commercial use, modification, and distribution with liability and trademark safeguards.

Apache-2.0 explicitly permits commercial use and proprietary modification without requiring source disclosure, so long as license and copyright notices are preserved. No commercial support vendor lock-in evident in the license itself; however, verify with Cilium/CNCF ecosystem vendors (Isovalent, etc.) for enterprise support terms and SLAs.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Strong
License clarity	Clear
Deployment complexity	High
DEV.co fit	Good
Assessment confidence	High

Security considerations

Cilium enforces policies at the kernel eBPF level, offering granular control and visibility compared to userspace alternatives. However, effectiveness depends on correct policy definition (identity misattribution, overly permissive defaults) and kernel security posture (eBPF verifier bugs, privilege escalation vectors). Supply chain risk: OCI image tampering, unsigned binaries. No security audit details provided in DATA; requires independent review. Cluster mesh introduces cross-cluster secret/cert distribution—compromise of one cluster can leak identity info to others.

Alternatives to consider

Calico

Pure policy engine without load balancing; simpler to operate but lacks eBPF performance and observability depth. Suitable for teams prioritizing ease-of-use over scale and L7 visibility.

Flannel + Kyverno

Lightweight overlay CNI with policy enforcement via separate controllers. Lower resource footprint but no eBPF optimizations, no distributed load balancing, no multi-cluster features.

AWS VPC-CNI / Azure CNI

Cloud-provider-native options leveraging managed infrastructure APIs. Tight integration with cloud security groups/NSGs but vendor lock-in and no cross-cloud multi-cluster support without additional tooling.

Software development agency

Build on cilium with DEV.co software developers

Cilium is powerful but requires kernel expertise and careful migration planning. Assess your team's eBPF familiarity, kernel version landscape, and complexity tolerance. Start with a pilot cluster and validate policy enforcement and observability integration before production rollout.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

hubble pixie kubeskoop

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Observability Cloud Deployment DevOps API Development Talk to DEV.co

cilium FAQ

Can Cilium fully replace kube-proxy?

Yes. Cilium's eBPF-based distributed load balancing (east-west via socket rewrite, north-south via XDP/eBPF) fully replaces kube-proxy. This eliminates per-packet NAT overhead and allows near-unlimited service density. Requires careful migration testing and monitoring.

What Linux kernels are supported?

Cilium requires kernel 4.19+ with eBPF support. Some advanced features (XDP, socket-level hooks) need kernel 5.x+. Consult Cilium's version-specific kernel compatibility matrix before deployment.

Does Cilium require a service mesh overlay?

No. Cilium provides network policies, load balancing, and observability out of the box. Optional service mesh features (Envoy integration, advanced traffic management) can be layered on top for applications that need them.

How does Cilium handle multi-cluster networking?

Cilium's Cluster Mesh uses etcd-based discovery, encrypted tunnels or direct L3 routing between clusters, and unified identity semantics. Global service discovery and cross-cluster failover are automatic given prerequisite L3 connectivity between cluster nodes.

Custom software development services

Need help beyond evaluating cilium? DEV.co is a software development agency offering software development services and web development for teams of every size. Our software developers and web developers build custom software, web applications, APIs, and open-source observability integrations — and maintain them long-term.

Evaluate Cilium for Your Infrastructure

Talk to DEV.co Schedule a Consultation