Cilium on marktaguiad.dev

Cilium Network Policy: CiliumNetworkPolicy

marktaguiad@marktaguiad.dev (Mark Taguiad) — Tue, 28 Apr 2026 00:00:00 +0000

CiliumNetworkPolicy (CNP) is the most commonly used policy type in Cilium.

It is namespace-scoped, meaning the policy applies only within the namespace where it is created.

This is the policy most teams use for real-world application security because it enables zero-trust controls at Layer 3, Layer 4, and Layer 7.

If Kubernetes NetworkPolicy is a basic firewall, CiliumNetworkPolicy is the full application-aware policy engine.

What discussed and showed here is similar with CiliumClusterwideNetworkPolicy, the only difference it the policy is cluster wide. Read more on that topic and how to combine these policies.

Cilium Network Policy: Kubernetes NetworkPolicy

marktaguiad@marktaguiad.dev (Mark Taguiad) — Sun, 26 Apr 2026 00:00:00 +0000

When people first start working with Cilium policies, the easiest way to understand them is to group them into two simple ideas:

Who can talk to what?
What they’re allowed to do once connected?

That mental model maps directly to how Cilium builds policy enforcement—from basic workload isolation all the way up to application-aware HTTP filtering.

If you already think in terms of namespace rules and Layer 7 rules like HTTP GET/POST like we did in Istio, you’re already on the right track. Cilium simply expands that model into something much more powerful and much more granular.

Cilium Gateway API

marktaguiad@marktaguiad.dev (Mark Taguiad) — Sat, 25 Apr 2026 00:00:00 +0000

Cilium Gateway API support is a modern replacement for traditional Kubernetes Ingress controllers.

Instead of relying on standalone ingress proxies, Cilium integrates Gateway API directly into the networking stack using eBPF and Envoy, enabling:

HTTP / HTTPS routing
TLS passthrough
TLS termination
Traffic splitting
Header manipulation
Standards-based ingress with Kubernetes Gateway API

Cilium’s operator acts as the Gateway API controller and manages:

GatewayClass
Gateway
HTTPRoute
LoadBalancer Services
eBPF traffic routing

This is similar with Istio Gateway, for our example let’s use the same deployments/apps.

Cilium ClusterMesh: Connecting Kubernetes Clusters

marktaguiad@marktaguiad.dev (Mark Taguiad) — Fri, 24 Apr 2026 00:00:00 +0000

Cilium is a Kubernetes CNI built on eBPF, replacing the traditional iptables-heavy networking model with kernel-level packet processing. Instead of relying on large iptables chains for routing, filtering, and service load balancing, Cilium injects eBPF programs directly into the Linux kernel datapath for lower latency and better scalability.

This would require a whole book in explaining eBPF, so we will not dwell in that. Let’s focus first on connecting two Kubernetes Cluster.