Systems

Architectural building blocks that span multiple binaries and many pkg/ subdirectories. These are not deployable units (those are apps) and not user-facing capabilities (those are features) — they are the engines that the apps and features build on top of.

System	Description
Datapath (eBPF)	The kernel-side packet path implemented in C, plus the userspace orchestrator that compiles and loads it.
Control plane (Hive)	The dependency-injection framework, lifecycle, and StateDB tables that organise the agent and operator.
API surface	REST (agent), gRPC (Hubble, FQDN), and CRDs that connect Cilium to the world.
Envoy and the L7 proxy	Embedded Envoy plus the xDS bridge for HTTP / gRPC / Kafka / TLS policy and Gateway API support.
kvstore	The optional etcd-backed shared store used by Cluster Mesh.
Identity allocation	How label sets become numeric identities consistently across nodes and clusters.