Cilium
What it is
Cilium is open-source software for providing, securing, and observing network connectivity between workloads using eBPF. Its networking use cases include CNI, Layer 4 load balancing, service mesh, ingress, IPv6, host firewall, BGP, and kube-proxy replacement. Security features include network policy, runtime security, and transparent encryption. Policies can enforce identity-aware rules across L3–L7, including DNS- and HTTP-aware filtering. Encryption options include IPsec, WireGuard, and ztunnel, whose support is marked beta. Hubble, built on Cilium and eBPF, provides visibility into service communication and behavior; listed observability capabilities include service maps, metrics and tracing export, and network flow logs. Documentation describes integrations with Prometheus and Grafana and Kubernetes support for services including GKE, AKS, EKS, OpenShift, RKE, k3s, and Alibaba ACK. Cilium is free and self-hosted for Linux on AMD64 or AArch64, requiring kernel 5.10 or later, or an equivalent kernel such as 4.18 on RHEL 8.10.
For and against
For
- Open-source software with no listed charge.
- Provides networking, security, and observability capabilities.
- Supports identity-aware L3–L7 network policies.
- Hubble provides visibility into service communication.
- Documents integrations with Prometheus and Grafana.
Against
- Requires AMD64 or AArch64 Linux hosts.
- Requires kernel 5.10 or later, or an equivalent.
- ztunnel encryption support is marked beta.
- Environments above 500 nodes need separate guidance.
The verdict
Cilium combines workload networking with policy enforcement, encryption, and observability, including visibility through Hubble. Check host architecture and kernel requirements before deployment; environments above 500 nodes are directed to separate large-environment guidance.
Who it suits
Cilium suits teams managing workload networking and security in Linux-based environments, including Kubernetes deployments. It may also suit operators who need identity-aware policies and visibility into service communication.
Plans and prices
Cilium
Open source · Linux kernel >= 5.10 or equivalent · AMD64 and AArch64
Read 3 Oct 2026 · cilium.io
On the record
- Community support
- Cilium documentation directs users to its FAQ, Slack channels, and GitHub issue tracker for help and bug reports.docs.cilium.io · read 3 Oct 2026
- Encryption
- Cilium supports transparent encryption of managed host and endpoint traffic using IPsec, WireGuard, or ztunnel; ztunnel support is marked beta.docs.cilium.io · read 3 Oct 2026
- Hubble
- Hubble is a distributed networking and security observability platform built on Cilium and eBPF that provides visibility into service communication and behavior.docs.cilium.io · read 3 Oct 2026
- Integrations
- Cilium documentation describes integrations with Prometheus and Grafana for metrics and dashboards.docs.cilium.io · read 3 Oct 2026
- Kubernetes support
- The quick installation guide lists Kubernetes distributions and services including GKE, AKS, EKS, OpenShift, RKE, k3s, and Alibaba ACK.docs.cilium.io · read 3 Oct 2026
- Networking
- Its listed networking use cases include CNI, Layer 4 load balancing, Cluster Mesh, kube-proxy replacement, BGP, service mesh, Gateway API, IPv6, host firewall, and ingress.cilium.io · read 3 Oct 2026
- Observability
- Cilium lists service maps, metrics and tracing export, identity-aware L3/L4/DNS network flow logs, and advanced network protocol visibility.cilium.io · read 3 Oct 2026
- Policy
- Cilium network policies can enforce identity-aware rules at L3–L7, including DNS- and HTTP-aware filtering.docs.cilium.io · read 3 Oct 2026
- Project status
- Cilium identifies itself as a CNCF graduated project.cilium.io · read 3 Oct 2026
- Purpose
- Cilium is an open source, cloud native solution for providing, securing, and observing network connectivity between workloads, powered by eBPF.cilium.io · read 3 Oct 2026
- Scale limitation
- The quick installation guide says environments larger than 500 nodes should refer to the Getting Started guide for large environments or specific datapath modes.docs.cilium.io · read 3 Oct 2026
- Security features
- Listed security capabilities include transparent encryption, network policy, and runtime security.cilium.io · read 3 Oct 2026
- Security review
- Cilium documentation links to 2022 security and fuzzing audits; the security audit summary reports no critical or high severity vulnerabilities found in that audit.docs.cilium.io · read 3 Oct 2026
- System requirements
- The container image requires AMD64 or AArch64 hosts running Linux kernel 5.10 or later, or an equivalent kernel such as 4.18 on RHEL 8.10.docs.cilium.io · read 3 Oct 2026
