Go C Shell C++ Makefile Python Other
Switch branches/tags
Clone or download
eloycoto and tgraf Test: Add Background process for kubernetes test.
Added a new helper function that dumps the given command output each
five seconds to provide more context of the system status.

Added the Uptime command output per each Cilium Pod in some kubernetes

Signed-off-by: Eloy Coto <eloy.coto@gmail.com>
Latest commit 721b93a Jul 19, 2018
Failed to load latest commit information.
.github Update docs related to cluster-diagnosis Apr 13, 2018
Documentation doc: Add example how to enforce Kubernetes namespace boundaries Jul 18, 2018
api/v1 bpf: Allow maintaining a local cache of BPF maps Jul 17, 2018
bpf policy: Update identity_is_reserved Jul 20, 2018
bugtool bugtool: Include cilium map list --verbose Jul 17, 2018
cilium-health add cilium-host IP to k8s node's annotation Jul 18, 2018
cilium bpf: Add MonitorAggregation option Jul 18, 2018
common option: Refactor BoolOptions into IntOptions Jul 18, 2018
contrib bpf: add cocci script to find wrong null checks Jul 19, 2018
daemon daemon: Generate IPCache prefixes for netdev program Jul 21, 2018
envoy bpf: Allow to use 24 bits for security identities Jul 17, 2018
examples Properly prefix aggregation level env variable name Jul 19, 2018
hack development: add cache to k8s components Apr 18, 2018
monitor move pkg/{apierror,apipanic,apisocket} -> pkg/api Jul 5, 2018
pkg maps/ipcache: Fix max limit for LPM prefix lengths Jul 21, 2018
plugins cni: Check if directories exist before creating them Jul 13, 2018
test Test: Add Background process for kubernetes test. Jul 21, 2018
tests tests: Fix 10-proxy.sh to wait for all endpoints to get an ID Jul 10, 2018
vendor deps: update k8s deps to 1.11.0 Jul 9, 2018
.authors.aux misc, docs: improve auto-generation of authors file Nov 29, 2017
.gitignore envoy: Build Istio Docker images May 8, 2018
.gitmodules envoy: Envoy integration. Nov 22, 2017
.mailmap docs: update mailmap and authors Apr 23, 2018
AUTHORS AUTHORS: Update to latest list Jun 22, 2018
CODEOWNERS CODEOWNERS: Shift ownership of ipcache to a team May 10, 2018
CONTRIBUTING.md Documentation: Re-work the contributor guide Jun 25, 2018
Dockerfile envoy: Update Envoy dependency to release 1.7.0 Jul 4, 2018
Gopkg.lock deps: update k8s deps to 1.11.0 Jul 9, 2018
Gopkg.toml deps: update k8s deps to 1.11.0 Jul 9, 2018
Jenkinsfile.nightly Push nightly image to dockerhub Jul 12, 2018
LICENSE LICENSE: Update copyright column Jun 26, 2018
Makefile makefile: Run go tool vet on the api and pkg subdirs Jul 20, 2018
Makefile.defs Makefiles: Quieten output Mar 17, 2018
Makefile.quiet Makefiles: Quieten output Mar 17, 2018
NEWS.rst Prepare for 1.0.0-rc9 release Apr 2, 2018
README.rst Various link fixes in documentation. May 16, 2018
VERSION VERSION: bump version to 1.1.90 Jun 26, 2018
Vagrantfile test: update Vagrantfiles to use box version 97 Jul 6, 2018
docs.Jenkinsfile Jenkins: Adjust Timeouts Jun 25, 2018
ginkgo-kubernetes-all.Jenkinsfile CI: Disable fail-fast on Jenkins if no label. Jul 11, 2018
ginkgo.Jenkinsfile CI: Disable fail-fast on Jenkins if no label. Jul 11, 2018
kubernetes-upstream.Jenkinsfile Vagrant: Update dev servers to cilium/ubuntu-dev box. Jun 19, 2018


Cilium Logo

Build Status Go Report Card GoDoc Read the Docs Apache licensed GPL licensed Join the Cilium slack channel

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to protect and secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium is integrated into common orchestration frameworks such as Kubernetes and Mesos.

A new Linux kernel technology called BPF is at the foundation of Cilium. It supports dynamic insertion of BPF bytecode into the Linux kernel at various integration points such as: network IO, application sockets, and tracepoints to implement security, networking and visibility logic. BPF is highly efficient and flexible. To learn more about BPF, read more in our extensive BPF and XDP Reference Guide.


Functionality Overview

Protect and secure APIs transparently

Ability to secure modern application protocols such as REST/HTTP, gRPC and Kafka. Traditional firewalls operates at Layer 3 and 4. A protocol running on a particular port is either completely trusted or blocked entirely. Cilium provides the ability to filter on individual application protocol requests such as:

  • Allow all HTTP requests with method GET and path /public/.*. Deny all other requests.
  • Allow service1 to produce on Kafka topic topic1 and service2 to consume on topic1. Reject all other Kafka messages.
  • Require the HTTP header X-Token: [0-9]+ to be present in all REST calls.

See the section Layer 7 Policy in our documentation for the latest list of supported protocols and examples on how to use it.

Secure service to service communication based on identities

Modern distributed applications rely on technologies such as application containers to facilitate agility in deployment and scale out on demand. This results in a large number of application containers to be started in a short period of time. Typical container firewalls secure workloads by filtering on source IP addresses and destination ports. This concept requires the firewalls on all servers to be manipulated whenever a container is started anywhere in the cluster.

In order to avoid this situation which limits scale, Cilium assigns a security identity to groups of application containers which share identical security polices. The identity is then associated with all network packets emitted by the application containers, allowing to validate the identity at the receiving node. Security identity management is performed using a key-value store.

Secure access to and from external services

Label based security is the tool of choice for cluster internal access control. In order to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular IP ranges.

Simple Networking

A simple flat Layer 3 network with the ability to span multiple clusters connects all application containers. IP allocation is kept simple by using host scope allocators. This means that each host can allocate IPs without any coordination between hosts.

The following multi node networking models are supported:

  • Overlay: Encapsulation based virtual network spawning all hosts. Currently VXLAN and Geneve are baked in but all encapsulation formats supported by Linux can be enabled.

    When to use this mode: This mode has minimal infrastructure and integration requirements. It works on almost any network infrastructure as the only requirement is IP connectivity between hosts which is typically already given.

  • Native Routing: Use of the regular routing table of the Linux host. The network is required to be capable to route the IP addresses of the application containers.

    When to use this mode: This mode is for advanced users and requires some awareness of the underlying networking infrastructure. This mode works well with:

    • Native IPv6 networks
    • In conjunction with cloud network routers
    • If you are already running routing daemons

Load balancing

Distributed load balancing for traffic between application containers and to external services. The loadbalancing is implemented using BPF using efficient hashtables allowing for almost unlimited scale and supports direct server return (DSR) if the loadbalancing operation is not performed on the source host.

Monitoring and Troubleshooting

The ability to gain visibility and to troubleshoot issues is fundamental to the operation of any distributed system. While we learned to love tools like tcpdump and ping and while they will always find a special place in our hearts, we strive to provide better tooling for troubleshooting. This includes tooling to provide:

  • Event monitoring with metadata: When a packet is dropped, the tool doesn't just report the source and destination IP of the packet, the tool provides the full label information of both the sender and receiving among a lot of other information.
  • Policy decision tracing: Why is a packet being dropped or a request rejected. The policy tracing framework allows to trace the policy decision process for both, running workloads and based on arbitrary label definitions.
  • Metrics export via Prometheus: Key metrics are exported via Prometheus for integration with your existing dashboards.


Getting Started

What is eBPF and XDP?

Berkeley Packet Filter (BPF) is a Linux kernel bytecode interpreter originally introduced to filter network packets, e.g. for tcpdump and socket filters. The BPF instruction set and surrounding architecture has recently been significantly reworked with additional data structures such as hash tables and arrays for keeping state as well as additional actions to support packet mangling, forwarding, encapsulation, etc. Furthermore, a compiler back end for LLVM allows for programs to be written in C and compiled into BPF instructions. An in-kernel verifier ensures that BPF programs are safe to run and a JIT compiler converts the BPF bytecode to CPU architecture specific instructions for native execution efficiency. BPF programs can be run at various hooking points in the kernel such as for incoming packets, outgoing packets, system calls, kprobes, uprobes, tracepoints, etc.

BPF continues to evolve and gain additional capabilities with each new Linux release. Cilium leverages BPF to perform core data path filtering, mangling, monitoring and redirection, and requires BPF capabilities that are in any Linux kernel version 4.8.0 or newer (the latest current stable Linux kernel is 4.14.x).

Many Linux distributions including CoreOS, Debian, Docker's LinuxKit, Fedora, and Ubuntu already ship kernel versions >= 4.8.x. You can check your Linux kernel version by running uname -a. If you are not yet running a recent enough kernel, check the Documentation of your Linux distribution on how to run Linux kernel 4.9.x or later.

To read up on the necessary kernel versions to run the BPF runtime, see the section Prerequisites.


XDP is a further step in evolution and enables to run a specific flavor of BPF programs from the network driver with direct access to the packet's DMA buffer. This is, by definition, the earliest possible point in the software stack, where programs can be attached to in order to allow for a programmable, high performance packet processor in the Linux kernel networking data path.

Further information about BPF and XDP targeted for developers can be found in the BPF and XDP Reference Guide.

Further Reading

Related Material


  • DockerCon, Austin TX, Apr 2017 - Cilium - Network and Application Security with BPF and XDP: Slides, Video
  • CNCF/KubeCon Meetup, Berlin, Mar 2017 - Linux Native, HTTP Aware Network Security: Slides, Video
  • Docker Distributed Systems Summit, Berlin, Oct 2016: Slides, Video
  • NetDev1.2, Tokyo, Sep 2016 - cls_bpf/eBPF updates since netdev 1.1: Slides, Video
  • NetDev1.2, Tokyo, Sep 2016 - Advanced programmability and recent updates with tc’s cls_bpf: Slides, Video
  • ContainerCon NA, Toronto, Aug 2016 - Fast IPv6 container networking with BPF & XDP: Slides


  • Software Gone Wild by Ivan Pepelnjak, Oct 2016: Blog, MP3
  • OVS Orbit by Ben Pfaff, May 2016: Blog, MP3

Community blog posts

Weekly Hangout

  • The developer community is hanging out on zoom on a weekly basis to chat. Everybody is welcome.
  • Weekly, Monday, 9:00 am PT, 12:00 pm (noon) ET, 6:00 pm CEST
  • Join zoom


If you have any questions feel free to contact us on Slack.


The cilium user space components are licensed under the Apache License, Version 2.0. The BPF code templates are licensed under the General Public License, Version 2.0.