Cilium

What it is

Cilium is an eBPF-based networking, security, and observability layer for Kubernetes and cloud-native environments. It functions as a CNI plugin, replacing iptables/kube-proxy-based packet handling with eBPF programs that run in the Linux kernel, giving you L3-L7 network policy enforcement, load balancing, and encryption without the overhead of traditional netfilter chains. It also ships Hubble, a native observability component that gives flow-level visibility into cluster traffic, and increasingly functions as a sidecar-free service mesh alternative to Istio/Linkerd for teams that want mesh capabilities without the sidecar tax.

Who builds it and why

Cilium is a CNCF Graduated project, one of the highest maturity signals CNCF gives out. Isovalent, the company founded by Cilium's original authors, has driven the bulk of development and was acquired by Cisco in 2024 — Cisco now backs the project commercially while it remains a CNCF-governed open source project. 1,361 contributors and an active commit history (last commit 2026-07-01) indicate this isn't a single-vendor side project on life support; it has a broad contributor base across cloud providers, enterprises, and independent engineers who depend on it for production traffic.

Production readiness signal

Cilium runs as the default or supported CNI on GKE, EKS Anywhere, AKS (via BYOCNI), OpenShift, and is used at hyperscale by companies like Adobe, Datadog, and others running thousands of nodes. CNCF Graduated status alone means it passed a formal maturity bar, but the real signal is elsewhere: 24,633 GitHub stars, continuous commit activity, Apache-2.0 licensing (no rug-pull risk on core functionality), and a release cadence that's currently at v1.19.5 — meaning it's had well over a dozen major/minor version cycles with active patch support. This is not a project you need to evaluate for "will it survive" — that question is settled. Your evaluation work is scoping the operational complexity you're taking on.

Who should use this

Teams running Kubernetes at scale who are hitting the ceiling of iptables-based networking (connection tracking table exhaustion, poor scaling past a few thousand services) are the clearest fit. If you need L7-aware network policy (HTTP method/path-based rules, gRPC-aware policy), multi-cluster networking (Cluster Mesh), or you want mesh-like traffic management without deploying Envoy sidecars everywhere, Cilium solves real problems here. Platform teams that already run eBPF-based tooling elsewhere (Falco, Pixie) and have the kernel version requirements sorted out will find the operational model familiar.

Who should NOT use this

If you're running a small cluster (under ~20 nodes) with basic networking needs, Cilium is over-engineering — Calico or the default CNI on your managed provider will do the job with less operational surface area. Teams without strong Linux kernel expertise should be cautious: eBPF debugging when something goes sideways (verifier rejections, kernel version incompatibilities) requires a different skill set than debugging iptables rules, and your on-call engineers need to be comfortable with that. Shops on older kernels (pre-4.19, ideally you want 5.10+) will hit feature gaps or be forced into compatibility modes that erase Cilium's performance advantage. And if you've already standardized on Istio/Linkerd sidecar mesh and it's working, migrating to Cilium's mesh model purely for the sidecar-removal benefit is not worth the churn unless sidecar overhead is an actual measured problem for you.

Alternatives

• Calico — more mature ecosystem for pure network policy use cases, simpler operational model, less L7 depth.
• Istio (with Ambient mesh) — if you need mature, sidecar-optional service mesh with a larger ecosystem of integrations, at the cost of more moving parts.
• kube-proxy + standard CNI (Flannel, etc.) — the boring default; fine until you hit the scale limits Cilium is built to solve.

Pricing

Cilium itself is fully open source under Apache-2.0 — no paid tier gates core functionality. Cisco/Isovalent sells "Isovalent Enterprise for Cilium" with additional support, compliance tooling, and enterprise features (FIPS builds, SLAs), but the upstream project is not crippled or feature-limited to push you toward that.