Glossary

Cilium-specific terminology. The upstream user-facing glossary lives in Documentation/glossary.rst; this page focuses on terms an engineer will encounter while reading the source.

Term	Meaning
Endpoint	An entity managed by Cilium with its own IP and security identity, usually a Kubernetes pod. The agent stores per-endpoint state in pkg/endpoint/ and a per-endpoint set of compiled BPF programs.
Identity	A 24-bit number (pkg/identity/numericidentity.go) derived from a workload's labels. Policy is expressed identity-to-identity, never IP-to-IP.
Selector / SelectorCache	Compiled label selectors that match identities. Lives in pkg/policy/selectorcache.go. Notifications flow when identities are added or removed.
Policy repository	The in-memory database of rules, rebuilt on every CRD change. See pkg/policy/repository.go.
Reserved identity	A small set of well-known identities (world, host, unmanaged, init, cluster, kube-apiserver) defined in pkg/identity/reserved.go.
ipcache	Map from IP address to security identity (pkg/ipcache/, BPF map cilium_ipcache). The dataplane consults it to resolve remote IPs to identities at packet receipt.
CT (conntrack) map	Per-endpoint or global map storing connection tracking entries (pkg/maps/ctmap/).
NAT map	Per-endpoint or global SNAT table (pkg/maps/nat/).
LB map	Service load balancing tables (pkg/maps/lbmap/).
Policy map	Per-endpoint map storing the allow/deny decision keyed by (identity, port, proto, traffic-direction) (pkg/maps/policymap/).
Hive / Cell	The dependency-injection framework (pkg/hive/). A cell.Cell is a unit of agent functionality; the agent assembles them in daemon/cmd/.
StateDB	An in-memory transactional database used for control-plane tables (vendor / pkg/datapath/tables/ and elsewhere). Replaces ad-hoc maps for things like routes, devices, and L2 announcements.
kvstore	Optional etcd-backed key-value store used by Cluster Mesh (pkg/kvstore/).
Cluster Mesh	Multi-cluster deployment mode where each cluster exports its identities/services to peers (pkg/clustermesh/, clustermesh-apiserver/).
Hubble	The flow observability layer (pkg/hubble/). Attaches to the monitor ring buffer and emits structured flow events.
Envoy	The L7 proxy embedded in or sidecar to the agent. Configured live via xDS (pkg/envoy/, pkg/proxy/).
DNS proxy	Userspace process or library inside the agent that intercepts DNS responses to learn FQDN-to-IP mappings (pkg/fqdn/, standalone-dns-proxy/).
Datapath	The eBPF programs and their orchestration (bpf/, pkg/datapath/).
Loader	The component that compiles BPF objects with clang and attaches them to interfaces (pkg/datapath/loader/).
Orchestrator	The agent component that decides which BPF programs go on which interface and triggers reloads (pkg/datapath/orchestrator/).
CES (CiliumEndpointSlice)	A scaling alternative to per-pod CiliumEndpoint CRDs. Operator batches endpoints into slices to reduce API server load (operator/pkg/ciliumendpointslice/).
CiliumNetworkPolicy / CCNP	Namespaced and cluster-wide variants of the Cilium policy CRD (pkg/policy/api/).
L7 redirect	When policy requires inspection, the dataplane sets a "redirect" action that punts the connection to the userspace proxy. The redirect is a per-port iptables/eBPF rule managed by pkg/proxy/.
Egress gateway	Feature that NATs egress traffic from selected pods through a chosen node IP (pkg/egressgateway/, bpf/lib/egress_gateway.h).
BGP control plane	Optional integration with FRR/GoBGP for advertising pod CIDRs and load balancer IPs (pkg/bgp/, cilium-cli/bgp/).
L2 announcer	ARP/NDP-based VIP announcement for LoadBalancer services without BGP (pkg/l2announcer/).
Bandwidth manager	EDT-based egress bandwidth shaping (pkg/bandwidth/ and bpf/lib/edt.h).
WireGuard	Built-in node-to-node encryption (pkg/wireguard/, bpf/bpf_wireguard.c).
socketlb	Connect-time load balancing in bpf/bpf_sock.c (pkg/socketlb/). Translates service VIPs to backend IPs in the connect() syscall before any packet is generated.
bpftool / bpfman	External tooling for introspecting loaded BPF programs. Cilium ships its own primitives in pkg/bpf/ and pkg/ebpf/.

For the canonical end-user glossary (DaemonSet, CNI, CRD, Helm, ...) see Documentation/glossary.rst.