Cilium

Cilium is a networking, observability, and security solution for cloud-native workloads, with an eBPF-based dataplane. It runs as a Kubernetes CNI plugin and replaces kube-proxy, providing identity-aware L3-L7 network policy, transparent encryption, multi-cluster connectivity, and deep flow visibility through Hubble.

What is in this repository

The github.com/cilium/cilium monorepo contains every piece that makes up a Cilium installation:

• The eBPF dataplane (bpf/) — C programs loaded into the Linux kernel that handle every packet entering or leaving a pod.
• The Cilium agent (daemon/) — the userspace process that runs on every node, programs the dataplane, and talks to the Kubernetes API.
• The Cilium operator (operator/) — a cluster-wide controller for IPAM, identity garbage collection, and CRD management.
• Supporting binaries: cilium-cli/, cilium-dbg/, cilium-health/, bugtool/, hubble/, hubble-relay/, clustermesh-apiserver/, and standalone-dns-proxy/.
• Hundreds of internal Go packages under pkg/ covering policy compilation, identity allocation, endpoint lifecycle, the BPF map abstraction, the kvstore, the L7 proxy integration, and more.

Who uses Cilium

Cilium is a CNCF Graduated project and the default CNI for many managed Kubernetes services. The USERS.md file lists production adopters. Common reasons teams pick Cilium:

• Replace kube-proxy to eliminate iptables scaling problems.
• Enforce identity-based network policy on L3-L7 with Kubernetes-native CRDs.
• Connect multiple clusters through Cluster Mesh with shared identity and global services.
• Observe every flow with Hubble — service maps, DNS-aware logs, and Prometheus metrics.
• Encrypt node-to-node traffic with WireGuard or IPsec.
• Run as a service mesh with sidecar-less L7 policy and the Kubernetes Gateway API.

Quick links

• Architecture — components and how packets flow.
• Getting started — build, test, and run from source.
• Glossary — Cilium-specific vocabulary.
• Apps — deployable binaries (agent, operator, CLI, Hubble, etc.).
• Systems — internal building blocks (datapath, control plane, kvstore, Envoy).
• Features — user-visible capabilities (policy, BGP, encryption, Cluster Mesh, etc.).

Project status

• License: Apache-2.0 for userspace, GPL-2.0 / BSD-2-Clause for BPF templates (see LICENSE, bpf/LICENSE.GPL-2.0, bpf/LICENSE.BSD-2-Clause).
• Current development version: 1.20.0-dev (see VERSION).
• Active stable branches: v1.17, v1.18, v1.19. See README.rst for the current release matrix.
• Governance: see MAINTAINERS.md and the community/GOVERNANCE.md.