Cilium Architecture

Cilium Architecture An architecture diagram generated by Archify. Kubernetes · Pods · Services · NetworkPolicy · Architecture component Kubernetes Pods · Services · NetworkPolicy Container Network Interface · kubelet ↔ plugin contract · Architecture component Container Network Interface kubelet ↔ plugin contract Cilium · cilium-agent · Operator · Architecture component Cilium cilium-agent · Operator eBPF · In-kernel programs · maps · Architecture component eBPF In-kernel programs · maps Linux Kernel · Packet processing path · Architecture component Linux Kernel Packet processing path Hubble · Flow observability · UI · Architecture component Hubble Flow observability · UI pod network request invokes CNI plugin loads programs attaches to hooks flow events Legend Backend Database Cloud Message bus External

Layering

  • • Kubernetes declares Pods, Services, and NetworkPolicies and delegates through the CNI contract
  • • The Cilium agent compiles those declarations into eBPF programs and maps
  • • Packet processing happens in the kernel, bypassing iptables chains

What eBPF buys you

  • • Lookups are hash-map based, so performance degrades gently as rules grow
  • • It can replace kube-proxy and handle Service load balancing in the kernel
  • • Policy reaches beyond L3/L4 into L7 (HTTP, gRPC, Kafka)

Hubble

  • • It collects the flow events Cilium emits and renders service dependencies
  • • Traffic dropped by policy shows up with the reason attached
  • • You query it either through the CLI (hubble observe) or the UI