Cilium Security Architecture

Cilium Security Architecture A workflow diagram generated by Archify. 01 / Identity & Policy 02 / Out-of-band Mutual Authentication 03 / Payload Encryption (opt-in) Workload · pod traffic · Identity & Policy Workload pod traffic Identity · Cilium label ID · Identity & Policy Identity Cilium label ID eBPF Policy · L3/L4 + L7 · Identity & Policy eBPF Policy L3/L4 + L7 SPIFFE/SPIRE · SVID issuance · Out-of-band Mutual Authentication SPIFFE/SPIRE SVID issuance Mutual Auth · out-of-band · Out-of-band Mutual Authentication Mutual Auth out-of-band WireGuard · or IPsec · opt-in · Payload Encryption (opt-in) WireGuard or IPsec · opt-in ztunnel mTLS · native · preview · Payload Encryption (opt-in) ztunnel mTLS native · preview identity proof auth result encryption choice Legend Agent logic Policy External system