Cilium eBPF, in two sentences and a diagram
You can describe Cilium in two sentences.
The interesting part is the diagram you draw in the third.
The two sentences
Cilium is a CNI plugin for Kubernetes that replaces iptables with eBPF programs running in the kernel. This means your network policy is enforced at the packet level, before it ever reaches userspace.
Why that matters
iptables has a well-known scaling problem. Every rule is a linear lookup. At 10,000 pods, you have 10,000 rules. At 50,000, you have 50,000. The latency compounds.
eBPF programs run as JIT-compiled bytecode directly in the kernel. The lookup is O(1). The policy enforcement is deterministic.
The diagram
Draw a packet arriving at a node. In iptables-land, it traverses a chain of rules — a linked list with O(n) characteristics. In Cilium’s eBPF land, the kernel invokes a hook that does a hash table lookup.
That’s it. That’s the whole architectural difference.
What this means operationally
- Network policy is enforced even if kube-proxy is broken
- You get identity-based policy (by pod label) rather than IP-based policy
- You can observe every packet with
hubblewithout any application changes - The blast radius of a misconfigured policy is immediate and visible
The catch
eBPF requires a relatively modern kernel (5.10+ for full features). If you’re running on old infrastructure, this isn’t available to you. On a homelab k3s cluster on Pi 4s running Raspberry Pi OS Bookworm, it just works.