Tooling

Build entry points

Make target	Effect
make	Build all Go binaries (cilium-agent, cilium-operator, cilium-cli, etc.) into their per-binary directories.
make -C bpf	Compile the BPF C programs to ELF objects.
make dev-docker-image	Build the agent container image locally.
make kind-image	Build images and load them into a kind cluster started via make -C cilium-cli kind.
make kind-install	Install Cilium from local images into the kind cluster.
make kind-install-quick	Reload the agent without re-running Helm.
make unit-tests	Go unit tests across the repo.
make tests-privileged	Privileged subset of unit tests (root + BPF).
make checkpatch	Lint commit messages, Go formatting, license headers.
make generate-api	Regenerate OpenAPI server/client (api/v1/).
make generate-k8s-api	Regenerate CRDs, deepcopy, listers, informers.
make -C Documentation html	Build the Sphinx docs.
make -C Documentation check	Run all Documentation/check-*.sh scripts.

Makefile.defs defines shared variables (GO_BUILD, BUILD_FLAGS, LIBNETWORK_PLUGIN, ...). Makefile.docker orchestrates multi-arch image builds. Makefile.kind is the kind helper.

Linters

• golangci-lint — config in .golangci.yaml. Enabled linters include revive, unused, staticcheck, gocritic, errorlint, gocheckcompilerdirectives, and the custom Cilium linters under tools/customcheck/.
• clang-format — .clang-format governs bpf/ and bpf/lib/. Run clang-format -i bpf/foo.c.
• shellcheck — covers scripts in Documentation/check-*.sh, contrib/, etc.
• License headers — enforced by make checkpatch.
• CRD-Helm-cmdref drift — enforced by Documentation/check-helmvalues.sh, Documentation/check-cmdref.sh, Documentation/check-crdlist.sh.

Code generation

• make generate-api (OpenAPI 2.0 → server/client Go).
• make generate-k8s-api (controller-tools deepcopy / CRD YAML).
• make -C api proto (gRPC → Go for Hubble protobufs).
• make -C bpf generate (struct alignment dumps, used by pkg/alignchecker/).
• Custom generators under tools/:
  • tools/dev-doctor/ — environment validator.
  • tools/sysctlfix/ — sysctl reconciler scaffolding.
  • tools/feature-completeness/ — coverage matrix for feature flags.
  • tools/spdxconv/ — license header utilities.

kind helpers

The Cilium dev loop favours kind:

# Create a kind cluster matching cilium-cli expectations
make -C cilium-cli kind

# Build images and load
make kind-image

# Install / reinstall
make kind-install        # full Helm install
make kind-install-quick  # rolling restart only

Makefile.kind exposes additional knobs for IPv6, IPSec, dual-stack, and cluster-mesh setups.

CI runners

GitHub Actions workflows are under .github/workflows/. Jobs run on:

• Ubuntu hosted runners — Go unit tests, lint, build.
• Ubuntu hosted runners with vmtest action — privileged BPF tests across multiple kernel versions.
• Self-hosted runners — connectivity tests on real Kubernetes clusters across cloud providers.
• Equinix bare-metal runners — performance / scale tests.

Required workflows are listed in .github/required-workflows.yaml (referenced by branch protection rules).

Renovate / dependency bots

renovate.json5 controls dependency upgrades — Go modules, Helm chart updates, image digests, vendored Envoy releases. The vendored Go tree is refreshed via go mod vendor in dedicated bot PRs.

OpenAPI editor

Editing api/v1/openapi.yaml is easier in the embedded Swagger editor:

make swagger-edit

This launches a containerised Swagger UI bound to the local file.