Lore

How the Cilium codebase grew from a single Docker network plugin into a CNCF Graduated project covering networking, observability, security, and service mesh. Dates are derived from git log, release tags, and directory creation history.

Eras

The pre-Kubernetes era (Dec 2015 – mid 2016)

Cilium began as a small project at Covalent Networks (later Isovalent). The first commit is dated 2015-12-16 ("Initial commit"). A few days later, on 2015-12-18, came the "Initial cilium-net docker plugin" commit. The earliest code targeted Docker libnetwork and an early version of Linux's BPF subsystem; eBPF tail-calls and the CO-RE relocation tooling did not yet exist. The agent was written in Go from day one.

The Kubernetes pivot (late 2016 – v1.0, Apr 2018)

By 2017 the project had reoriented around Kubernetes. The CNI plugin entry under plugins/cilium-cni/ and the first Kubernetes watchers in pkg/k8s/ date from this period. v1.0.0 shipped in April 2018, formalising the agent + operator split and the use of CRDs (CiliumNetworkPolicy, CiliumEndpoint) as the source of truth.

Hubble and L7 awareness (v1.6 – v1.10, mid 2019 – mid 2021)

Two major capability waves arrived:

• Hubble was added as a separate component for flow visibility (pkg/hubble/, hubble/, hubble-relay/). Earlier flow-event work lived inside the agent's monitor; Hubble factored it into a stable observability surface.
• L7 enforcement via Envoy matured. The custom cilium.l7policy Envoy filter and xDS plumbing under pkg/envoy/ and pkg/proxy/ replaced the original go-based proxy.

This era also saw the first Cluster Mesh code (pkg/clustermesh/, clustermesh-apiserver/) appear, enabling cross-cluster identity and services over an etcd-backed control plane.

The kube-proxy replacement era (v1.6 – v1.12, late 2019 – mid 2022)

Cilium gained a full kube-proxy replacement (pkg/loadbalancer/, bpf/bpf_sock.c for socket-LB, bpf/bpf_xdp.c for XDP-accelerated north-south LB). This required deep rewrites to the LB BPF maps (pkg/maps/lbmap/) and the addition of features like Maglev consistent hashing (pkg/maglev/), DSR, and bandwidth manager (pkg/bandwidth/).

The Hive era (v1.13 – v1.16, late 2022 – 2024)

The agent's wiring was transformed from a giant daemon.NewDaemon() constructor into a graph of dependency-injected Hive cells (pkg/hive/). Subsystems were ported one at a time: the BPF orchestrator, the kvstore, the L2 announcer, the BGP control plane, the K8s watchers, etc. The migration is still ongoing for some legacy paths, but every new feature is now expected to land as a cell.

A parallel rewrite replaced ad-hoc maps with a transactional in-memory database (StateDB) in pkg/datapath/tables/ and other table packages, giving the agent ACID semantics for the routes/devices/loadbalancer state it programs into BPF.

The service-mesh and Gateway API era (v1.14 – v1.18, 2023 – 2025)

The Gateway API integration (pkg/ciliumenvoyconfig/, Envoy listener generation), mutual authentication (pkg/auth/), and the SPIFFE-based identity layer landed during this era. WireGuard transparent encryption (pkg/wireguard/, bpf/bpf_wireguard.c) graduated to GA, and the project moved toward a sidecar-less service mesh model.

Today (v1.19 / v1.20-dev, 2025 – 2026)

The current main branch (development version 1.20.0-dev) continues to push on:

• Standalone DNS proxy (standalone-dns-proxy/) for FQDN policy at higher scale.
• Envoy cilium-envoy distribution and tighter xDS lifecycle management.
• Continued StateDB conversions of legacy tables.
• BGPv2 control plane (pkg/bgpv2/-style modernisations under pkg/bgp/).
• Multicast (pkg/multicast/, pkg/mcastmanager/) and ztunnel (pkg/ztunnel/) integrations.

Longest-standing features

• CNI plugin (plugins/cilium-cni/) — present since the Kubernetes pivot in 2016, continuously refactored but never replaced.
• Endpoint state machine (pkg/endpoint/) — the core data structure tracking each pod's identity, policy, and BPF programs. Its core types (Endpoint, policy.SelectorPolicy) have been stable for years.
• Policy repository (pkg/policy/repository.go) — the in-memory rule database has survived multiple selector-cache and identity rewrites.
• BPF map abstraction (pkg/bpf/) — Cilium maintained its own typed map wrapper long before the Go ecosystem coalesced around cilium/ebpf.

Major rewrites

• Hive migration (2022 – ongoing). Wholesale move from imperative wiring in daemon/cmd/ to declarative cell.Cell definitions across pkg/.
• Identity allocator (multiple). From a centralised etcd-only allocator to a CRD-based allocator (pkg/identity/cache/, pkg/allocator/) with kvstore as a fallback.
• Endpoint regeneration pipeline (multiple). The path from "policy changed" to "BPF reloaded" was rewritten to use bounded queues (pkg/endpoint/endpoint_build_queue.go) and to avoid full recompiles when only maps changed.
• L7 proxy. The original Go-based redirect proxy was replaced by Envoy with a custom Cilium filter (mid-2018).
• CES (CiliumEndpointSlice). Added in v1.11 to scale large clusters by batching CiliumEndpoint resources at the operator (operator/pkg/ciliumendpointslice/). Replaces per-pod CEP CRDs in large clusters.
• kvstore swap. Cluster Mesh used to require shared etcd; the introduction of clustermesh-apiserver made each cluster export a small etcd that peers can read.

Deprecated features

• Consul kvstore — appears in older docs as an option alongside etcd. Removed; only etcd remains supported (pkg/kvstore/etcd.go).
• Sidecar Envoy mode — early L7 mode that ran an Envoy sidecar per pod. Replaced by the per-node Envoy and now removed.
• Native Cilium proxy — original Go proxy. Replaced entirely by Envoy.
• cilium policy import / cilium policy delete REST endpoints — once authoritative, now informational; CRDs are the source of truth.
• Legacy KVStoreMesh control plane — the kvstoremesh binary is being subsumed by clustermesh-apiserver's built-in mesh of etcd instances.

Where deprecation is in progress rather than complete, the source files remain but are flagged via build tags or alpha/beta markers in Documentation/alpha.rst and Documentation/beta.rst.

Growth trajectory

• 2015: 21 commits — proof-of-concept Docker plugin.
• 2016 – 2018: ~3,000–4,000 commits/year — Kubernetes pivot, v1.0 release.
• 2019 – 2022: ~3,500–4,500 commits/year — kube-proxy replacement, Hubble, Cluster Mesh.
• 2023 – 2025: ~5,800–6,500 commits/year — Hive migration, service mesh, Gateway API, BGPv2, mutual auth.
• 2026 YTD (through April): ~1,400 commits — continued Hive conversions, standalone DNS proxy, Envoy lifecycle work.

The contributor base broadened from a single company to a cross-organisation effort: maintainers today are affiliated with Isovalent (now part of Cisco), Datadog, Microsoft, Google, AMD, Hedgehog, Ledger, and Palantir, among others (see MAINTAINERS.md).