cilium/cilium
Cilium
Cilium is a networking, security, and observability platform for containerized environments that leverages kernel-level data paths to process traffic. By executing programs directly within the Linux kernel, it provides high-performance packet filtering, routing, and load balancing without the need for traditional user-space proxies or context switching.
The platform distinguishes itself through identity-based security enforcement, which filters traffic based on service labels rather than volatile IP addresses. It integrates containerized workloads with external physical or virtual infrastructure using standard routing protocols and supports multi-cluster connectivity by linking independent environments into a unified network fabric.
Beyond its core networking capabilities, the project provides comprehensive observability into connectivity patterns and security events across distributed systems. It includes features for transparent network encryption, egress traffic control, and automated IP address management to maintain consistent communication and security policies across large-scale deployments.
Features
- Kubernetes Traffic Controllers - Provides high-performance traffic routing, load balancing, and network policy enforcement for containerized environments.
- Kernel Networking Hooks - Executes custom programs directly within the kernel to process network packets without context switching.
- Network Policy Enforcement - Enforces identity-based network security policies to restrict traffic between services and prevent unauthorized access within the cluster.
- Identity-Based Access Control - Filters traffic based on cryptographic service identities rather than volatile IP addresses.
- Kubernetes Security - Enforces identity-based access control and traffic filtering policies between containerized services.
- Network Security Tools - Monitors, filters, and encrypts traffic between services using kernel-level data paths.
- Multicluster Service Meshes - Connects independent environments to enable seamless service discovery and secure communication across locations.
- Load Balancing - Distributes incoming service requests across backend pods using high-performance kernel-level data paths to ensure efficient service availability.
- Multi-Cluster Connectivity Fabrics - Provides a unified network fabric that links independent container clusters for seamless cross-cluster service discovery and communication.
- Transparent Network Proxies - Distributes traffic across service endpoints using kernel-level maps to eliminate proxy latency.
- Network Traffic Controllers - Directs outbound traffic through dedicated gateways and enforces security policies for external connectivity without requiring application-level changes.
- Network Routing and Traffic Management - Directs network packets across endpoints using kernel-level data paths to optimize system efficiency and reliability.
- Network Routing Protocols - Exchanges network reachability information with physical infrastructure using standard routing protocols to integrate containerized workloads.
- Packet Processing Frameworks - Intercepts incoming network traffic at the driver layer for high-performance packet filtering.
- Network Encryption - Secures data in transit between nodes by automatically encrypting packets to prevent unauthorized interception.
- Monitoring and Observability - Provides deep visibility into connectivity patterns and security events across distributed systems.
- API Gateways - Networking and security layer using BPF for API-aware traffic.
- DevOps and Infrastructure - eBPF-based networking and security.
- Networking - eBPF-based networking, observability, and security platform.
- Networking and Security - Networking and security policy enforcement for containers.
- Networking & Connectivity - API-aware networking and security using eBPF.
- Security and Compliance - eBPF-based networking, observability, and security.
- Containerized Service Integrations - Advertises containerized service prefixes to external routers to bridge workloads with physical infrastructure.
- Network Gateways - Integrates containerized workloads with external infrastructure by advertising network prefixes via standard routing protocols.
- Load Balancer IP Address Management - Assigns and tracks unique identifiers for services to ensure scalable communication across containerized workloads.
- Distributed Key-Value Stores - Synchronizes network configuration and security policies across nodes to maintain a consistent cluster topology.
