Cilium is networking software for Kubernetes that connects containers, enforces security policies and observes traffic, all of it built on eBPF, a technology of the Linux kernel. The project was started by the company Isovalent, with Thomas Graf among its co-creators, and its 1.0 release was announced on 24 April 2018. It now belongs to the Cloud Native Computing Foundation, which accepted it as an incubating project in October 2021 and declared it graduated on 11 October 2023. The user-space code is released under the Apache 2.0 licence, and Cisco, which completed its acquisition of Isovalent in April 2024, pledged to keep supporting the community.
What Cilium is for
In a Kubernetes cluster every pod needs an address, must reach the other pods and must be able to call services. That job belongs to a CNI plugin, and Cilium is one of them. What sets it apart is the method: instead of stacking iptables rules or going through a virtual switch, it loads eBPF programs straight into the kernel, at the points where packets, connections and system calls pass. The kernel then runs the routing, filtering and load-balancing logic itself, without copying traffic to an external process.
This changes how services are distributed. According to the project README, Cilium completely replaces kube-proxy by rewriting connections at the connect call, using eBPF hash tables, which avoids per-packet address translation. Network policies no longer depend on IP addresses, which keep changing inside a cluster, but on an identity assigned to every group of pods sharing the same labels. Those policies reach the application layer: a rule can allow only HTTP GET requests to a given path, or restrict outbound traffic to a list of domain names.
A comparison with Open vSwitch, which sits in the same section of our software library, helps to place the tool. Open vSwitch is a programmable virtual switch designed for hypervisors and software-defined networks, and it thinks in OpenFlow flows. Cilium does not try to be a switch: it thinks in services, identities and Kubernetes policies, and it targets a cluster of containers rather than a fleet of virtual machines.
Around the networking core the project gathers several components. Hubble watches flows from layer 3 to layer 7 and renders them as metrics, logs and a service map. Cluster Mesh links several clusters so that a service in one can be discovered and reached from another. Traffic between nodes can be encrypted with IPsec or WireGuard, and an implementation of the Kubernetes Gateway API handles incoming traffic.
Who is it for?
Cilium is meant for teams running Kubernetes clusters in production: platform engineers, SREs and security owners who want precise policies and visibility into what moves between services. According to CNCF announcements, Google Cloud, AWS, Microsoft Azure, Alibaba and DigitalOcean offer it in their managed Kubernetes services. A reader learning Kubernetes can try it on a local cluster with kind or minikube, as the documentation suggests.
The requirements are real. The documentation asks for a Linux kernel of at least 5.10, built with the eBPF options and BTF type information, and features such as BIG TCP or netkit mode need even newer kernels. Cilium has no purpose outside a container environment: to connect virtual machines or physical hosts, Open vSwitch or a software router such as FRRouting remain the right tools. Finally, understanding why an eBPF program dropped a packet takes some learning, even though Hubble makes troubleshooting much easier.
Download Cilium safely
Cilium is deployed as container images, published by the project on quay.io, rather than as a conventional installer. The official documentation at docs.cilium.io lays out the steps: download the cilium CLI binary from the GitHub releases of the cilium/cilium-cli repository, check its checksum, then run the install command that pulls the images of the stable version, 1.20.2 at the time of writing. A Helm chart is available for advanced deployments, and images exist for AMD64 and AArch64.
The project is free and needs no licence. Isovalent, now part of Cisco, sells an enterprise edition with support and extra features, but the community version is complete for everyday use. The thing to watch here is the images: use only those from the quay.io/cilium repository referenced by the documentation, because a tampered networking image would run with kernel privileges on every node of the cluster.
Frequently asked questions
Is Cilium free?
Yes. The user-space code is released under the Apache 2.0 licence and the BPF code templates under a dual GPL v2 and 2-clause BSD licence, according to the README. A commercial edition exists from Isovalent, a Cisco subsidiary, but it is not required to run the project.
Does Cilium work without Kubernetes?
Its main role is that of a CNI plugin for Kubernetes. The documentation also covers attaching external workloads to a cluster and a standalone load balancer mode, but those cases remain marginal compared with deployment inside a cluster.
Which Linux kernel version is required?
The documentation requires kernel 5.10 or newer, with an exception for the 4.18 kernel of RHEL 8.10. Common distributions are listed with their minimum versions, for instance Ubuntu 20.04, Debian 10 or RHEL 8.6. Recent features such as netkit need kernel 6.8.
