Dependencies

Go

The Go module is github.com/cilium/cilium (go.mod), pinning Go 1.26.0 (as of main at the time of writing). Dependencies are vendored under vendor/ so builds reproduce without a module proxy.

Major direct dependencies

Module	Used by
k8s.io/client-go, k8s.io/api, k8s.io/apimachinery	All Kubernetes interaction.
k8s.io/apiextensions-apiserver	CRD installation by the operator.
sigs.k8s.io/controller-runtime	Used by some operator-side controllers.
sigs.k8s.io/gateway-api	Gateway API integration.
sigs.k8s.io/mcs-api	Multi-Cluster Services API.
github.com/cilium/ebpf	Vendored BPF library.
github.com/cilium/hive, github.com/cilium/statedb	DI + transactional tables.
github.com/cilium/proxy	Cilium-flavoured Envoy filter Go bindings.
github.com/envoyproxy/go-control-plane	xDS server scaffolding.
github.com/osrg/gobgp/v3	BGP control plane.
golang.zx2c4.com/wireguard/wgctrl	WireGuard via netlink.
github.com/spiffe/spiffe-csi, github.com/spiffe/go-spiffe/v2	SPIFFE identity for mutual auth.
github.com/vishvananda/netlink	Netlink primitives.
github.com/miekg/dns	DNS proxy.
github.com/prometheus/client_golang	Metrics.
github.com/spf13/cobra / pflag / viper	CLI scaffolding for every binary.
github.com/go-openapi/...	OpenAPI generation.
google.golang.org/grpc	Hubble gRPC.
go.etcd.io/etcd/client/v3, server/v3	etcd client + embedded server (clustermesh-apiserver).
helm.sh/helm/v3	Helm chart embedding for cilium-cli.
k8s.io/component-base/logs	Optional logging compatibility.
github.com/cilium/charts	Ancillary chart helpers.
github.com/google/gops/agent	Runtime introspection.
github.com/cilium/proxy/...	Custom Envoy filter scaffolding.

The full set is in go.mod. Renovate keeps direct and transitive dependencies updated.

C / BPF

• clang/LLVM ≥ 18 is required to build the BPF C code. The agent image embeds a clang toolchain so it can compile programs at runtime.
• BPF helper headers come from the Linux kernel UAPI (vendored under bpf/include/uapi/).
• cilium/ebpf (Go library) handles map/program loading from userspace.

Build tools

• go-swagger (vendored under tools/) — OpenAPI codegen.
• protoc + Go plugins — Hubble proto codegen.
• controller-tools (controller-gen) — CRD codegen.
• golangci-lint — Go linting.
• clang-format — BPF C formatting.

Runtime requirements

• Linux kernel ≥ 4.19 in theory, but recent features expect 5.4+ and many features expect even newer kernels (BTF, CO-RE, large LRU maps, sock LB, BPF token, ...). Documentation/operations/system_requirements.rst is authoritative.
• bpffs mounted at /sys/fs/bpf/.
• CNI plugins directory writable.
• iproute2 + iptables/nftables runtime utilities (used by some fallback paths).
• clang/LLVM baked into the image.

Documentation

• Sphinx + restructured text under Documentation/. The chart-aware Makefile orchestrates the docs build.
• requirements.txt in Documentation/ pins Python dependencies for the docs build.

License compliance

• FOSSA tracks third-party licenses; the badge is in README.rst.
• tools/spdxconv/ enforces SPDX headers on every source file.
• The LICENSE, bpf/LICENSE.GPL-2.0, and bpf/LICENSE.BSD-2-Clause files cover the project's tri-licensing.

How dependencies are bumped

• Renovate (config in renovate.json5) opens PRs for go.mod, Helm chart digests, and image tags.
• A maintainer reviews and merges; transitive Go dependency updates run go mod tidy && go mod vendor.
• Vendored Envoy bumps are coordinated with cilium/proxy releases.