Kernel-Level Network Microsegmentation via eBPF & Cilium

The Bottlenecks of Legacy iptables

Legacy Linux packet filtering using iptables traverses rule chains sequentially in linear time $O(N)$. In Kubernetes clusters scaling beyond 5,000 services, rule traversal consumes significant CPU overhead and introduces latency jitter. More critically, iptables operates blindly on IP addresses and ports, possessing zero understanding of application protocol context (HTTP methods, paths, or gRPC methods).

The eBPF Revolution

Extended Berkeley Packet Filter (eBPF) allows running sandboxed programs inside the Linux kernel without changing kernel source code or loading kernel modules. Cilium compiles declarative network policies directly into in-kernel BPF byte-code, executing lookups in constant time $O(1)$ through in-kernel BPF hash maps.

Key Capabilities

1. L7 Protocol Filtering: Restrict pods to specific HTTP methods and URL paths (e.g. allow only POST /v1/charge, reject DELETE /v1/customers).
2. Transparent WireGuard Encryption: Automatically encrypt all pod-to-pod cross-node traffic in the Linux kernel without requiring sidecar proxies or application code changes.
3. DNS-Aware Egress Policies: Restrict external egress to exact fully-qualified domain names (FQDNs), defeating DNS exfiltration attacks.

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-payment-api
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: payment-api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: checkout-gateway
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "POST"
                path: "/v1/charge"
  egress:
    - toFQDNs:
        - matchName: "api.stripe.com"
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP