Kubernetes Network Policies: Calico vs Cilium eBPF
By default, Kubernetes flat networking models allow uninhibited IP-level communication between all pods across all namespaces. If an attacker compromises a single vulnerable frontend container or public ingress pod, they can scan the internal pod network and access sensitive database, cache, or internal microservice endpoints laterally without restriction.
Kubernetes Network Policies enforce zero-trust firewalls at the pod network boundary. Project Calico uses Linux iptables or IPVS rules combined with BGP routing for reliable L3/L4 network isolation. Cilium leverages in-kernel eBPF (Extended Berkeley Packet Filter) maps to bypass iptables entirely, delivering wire-speed L3-L7 filtering, transparent mTLS, and dynamic FQDN egress control. This guide compares Calico and Cilium on performance, eBPF map sizing, L7 HTTP filtering, and network policy logging.
Mental Model: Default Open Pod Networks vs Zero-Trust Network Policy Isolation
Standard Kubernetes CNI plugins route network packets freely between all pod IP addresses:
1. Default Allow-All Network: Frontend pods can connect directly to backend database pods on port 5432 or internal payment APIs.
2. Zero-Trust Network Isolation: Applying a default-deny ingress and egress policy (NetworkPolicy) blocks all un-explicitly authorized network connections. For eBPF security and mTLS microservice architecture, review securing cloud native applications ebpf cilium tetragon and securing microservices mutual tls mtls cert manager.
Quick reference
- Default Kubernetes networking enables unrestricted lateral attack movement across namespaces.
- Default-deny NetworkPolicy rules block all network ingress and egress by default.
- Label selectors restrict pod-to-pod connections exclusively to authorized application roles.
- Prevents compromised edge containers from accessing backend database or secret infrastructure.
- Secures cloud-native Kubernetes clusters at Palantir, Datadog, Bloomberg, Adobe, and CoreConcept.
Remember this
Enforce default-deny NetworkPolicies to block lateral threat movement across Kubernetes pods.
Calico BGP Routing & iptables / IPVS Packet Filtering
Project Calico is a widely adopted CNI plugin that enforces standard Kubernetes NetworkPolicy objects:
- Felix Agent: Runs as a DaemonSet on every node, programming kernel iptables or IPVS rules to evaluate incoming and outgoing packets.
- BGP Route Reflector: Uses BGP (Border Gateway Protocol) to distribute pod IP routes across nodes without requiring encapsulation overhead (VXLAN/IPIP) on flat L2 networks.
Quick reference
- Felix DaemonSet translates Kubernetes NetworkPolicy objects into Linux iptables/IPVS rules.
- BGP routing delivers high-performance unencapsulated pod networking on native L2 fabrics.
- Calico eBPF data plane mode offers an optional upgrade path away from legacy iptables.
- Supports GlobalNetworkPolicy CRDs for cluster-wide and node-level firewall rules.
- Battle-tested in production across thousands of enterprise Kubernetes clusters.
Remember this
Deploy Calico for proven L3/L4 iptables network isolation and native BGP routing.
Cilium eBPF BPF Maps & High-Speed L3-L7 Wire-Speed Security
Cilium bypasses iptables by compiling security policies directly into in-kernel eBPF programs:
1# CiliumNetworkPolicy: L7 HTTP Method Filtering2apiVersion: "cilium.io/2"3kind: CiliumNetworkPolicy4metadata:5 name: allow-frontend-to-backend-get-only6spec:7 endpointSelector:8 matchLabels:9 app: backend10 ingress:11 - fromEndpoints:12 - matchLabels:13 app: frontend14 toPorts:15 - ports:16 - port: "8080"17 protocol: TCP18 rules:19 http:20 - method: "GET"21 path: "/api/v1/catalog.*"Quick reference
- In-kernel eBPF maps filter packets in constant $O(1)$ time, outperforming $O(N)$ iptables sequential scans.
- L7 CiliumNetworkPolicies inspect HTTP methods, paths, and gRPC method calls directly.
- Transparent mTLS encrypts pod-to-pod traffic without requiring sidecar proxies (Istio/Linkerd).
- Cilium Hubble delivers deep network flow visualization and packet drop debugging.
- Native IPAM and kube-proxy replacement for high-scale Kubernetes clusters.
Remember this
Use Cilium eBPF to achieve $O(1)$ wire-speed packet filtering and fine-grained L7 HTTP security.
Enforcing L7 HTTP/gRPC FQDN Policies & Network Policy Audit Logging
Securing egress traffic from Kubernetes pods to external SaaS endpoints requires domain-based filtering:
- FQDN Egress Policies: Cilium toFQDNs policies restrict outbound connections to specific external domains (e.g. api.stripe.com), dynamically resolving DNS IPs via eBPF DNS proxying.
- Audit & Flow Logging: Cilium Hubble and Calico Enterprise stream flow logs (JSON / OpenTelemetry) to SIEM systems for real-time security policy violation alerts.
Quick reference
- toFQDNs rules restrict pod egress to verified external SaaS domain names (e.g., Stripe, AWS S3).
- eBPF DNS proxying captures dynamic IP changes without requiring static IP whitelist updates.
- Hubble flow logs record accepted and dropped network flows with pod label context.
- Export flow telemetry to Prometheus, Grafana, or Datadog for compliance auditing.
- Hardens Kubernetes workloads against command-and-control (C2) data exfiltration.
Remember this
Implement FQDN egress rules to prevent compromised containers from exfiltrating data to external IPs.
Key takeaway
To test Cilium locally, install via cilium install on Minikube or Kind. Verify eBPF map status via cilium status and inspect flows using hubble observe.
Related Articles
Explore this topic