eBPF-based CNI with Gateway API support and L7 proxy capabilities

Component Information

Property	Value
Chart Version	latest
Chart Type	application
Upstream Project	cilium
Maintainers	Platform Engineering Team (repo)

Why Cilium?

Cilium is built on eBPF, which operates at the kernel level with minimal overhead. Traditional CNIs work in userspace and require context switches for every network operation. Cilium bypasses that, delivering higher throughput and lower latency while consuming fewer CPU cycles.

Performance is one factor, but Cilium also consolidates multiple functions into a single component:

• Networking: Full-featured CNI with kube-proxy replacement
• Observability: Hubble provides network-level visibility without requiring application instrumentation
• Security: NetworkPolicy engine capable of L3/L4 and L7 filtering
• Gateway API: Native implementation of Kubernetes Gateway API for L7 routing
• Service Mesh: Sidecar-free mesh capabilities (mTLS, load balancing, observability)

In an edge environment where resources are fixed, consolidating networking, observability, and security into one component reduces the total resource footprint. The alternative is deploying separate tools for each function, each with its own overhead.

Cilium works across deployment sizes without requiring architectural changes, from edge setups to large clusters.

Architecture Role

Cilium sits at Layer 0 of the platform, the infrastructure core. It’s the substrate that everything else depends on. Without Cilium, pods can’t communicate, services can’t be reached, and the Gateway can’t route traffic.

Key integration points:

• Gateway API: Cilium implements the Gateway API natively, handling L7 routing for all exposed services
• Hubble → Prometheus: Network metrics flow from Hubble to Prometheus via ServiceMonitors
• NetworkPolicy Engine: Ready to enforce network segmentation (currently configured but not actively used)
• Envoy Proxy: Embedded Envoy handles L7 features (HTTP routing, observability, eventual mTLS)

The configuration disables some features for the k3d demo environment (BPF host routing, masquerading, encryption) because they interfere with Docker bridge networking. On bare metal or VMs, these would be enabled for additional performance and security gains.

See Architecture Overview for how Cilium fits into the broader platform design.

Configuration Values