Cilium

Cilium is open-source software for connecting, securing, and observing network traffic between workloads. It is best suited to teams operating Linux-based environments, particularly Kubernetes clusters, that need granular policy and visibility alongside networking. Its broad capabilities are compelling, but kernel compatibility and deployment scale deserve attention before adoption.

Overview

Powered by eBPF, Cilium brings workload networking, security controls, and observability into one platform. That breadth can help teams manage these concerns together, but it is more than a minimal networking component; organizations wanting only a narrow connectivity tool may not need its full scope.

Its networking use cases include CNI, Layer 4 load balancing, Cluster Mesh, kube-proxy replacement, BGP, service mesh, Gateway API, IPv6, host firewall, and ingress. The hybrid deployment and control-plane models, policy segmentation, and northbound API make it relevant to organizations managing network policy across workloads.

Key features

Policy and security

Cilium can enforce identity-aware network rules from L3 through L7, including DNS- and HTTP-aware filtering. This is useful when teams need controls that account for workload identity and application traffic, rather than relying only on broad network boundaries. Its security capabilities also include runtime security and transparent encryption.

Encryption for managed host and endpoint traffic can use IPsec, WireGuard, or ztunnel. Because ztunnel support is beta, teams considering that option should account for its status rather than treating it as a mature default.

Observability

Hubble, Cilium’s distributed observability platform built on eBPF, provides visibility into service communication and behavior. Service maps, metrics and tracing export, identity-aware L3/L4/DNS flow logs, and protocol visibility give operators several ways to examine network activity. Prometheus and Grafana integrations support metrics and dashboards, making the observability capabilities useful for teams already using those tools.

Pricing

Cilium is open source and its Cilium plan costs nothing. There are no paid tiers to weigh against reduced capabilities, so the decision is less about subscription cost than whether the environment and operating model fit. The plan requires Linux kernel 5.10 or equivalent and AMD64 or AArch64 hosts.

Platforms

Cilium is Linux and self-hosted software. Its container image requires AMD64 or AArch64 hosts running Linux kernel 5.10 or later, with 4.18 on RHEL 8.10 cited as an equivalent kernel. The quick installation guide covers Kubernetes distributions and services including GKE, AKS, EKS, OpenShift, RKE, k3s, and Alibaba ACK. Environments above 500 nodes should follow the guidance for large environments or specific datapath modes; that is an important deployment consideration for larger clusters.

Who it's for

Cilium is a strong fit for platform and security teams running Linux workloads that need networking, identity-aware policy, and traffic visibility in the same system. Kubernetes operators with varied networking requirements may benefit from its wide use-case coverage. It is a weaker fit for teams seeking a hosted service, working outside its Linux and architecture requirements, or looking for a narrowly scoped network plugin.

Cilium identifies as a CNCF graduated project. Its documentation points users to an FAQ, Slack channels, and GitHub issue tracker for help and bug reports. Documentation also links to 2022 security and fuzzing audits; the security audit summary reported no critical or high severity vulnerabilities in that audit.

Pros and cons

• Broad workload networking: CNI, load balancing, Cluster Mesh, BGP, service mesh, Gateway API, IPv6, host firewall, and ingress address diverse cluster needs.
• Fine-grained policy: Identity-aware L3–L7 rules, including DNS- and HTTP-aware filtering, suit teams that need application-level network controls.
• Useful traffic visibility: Hubble combines service communication views with flow logs, metrics, tracing export, and protocol visibility.
• Infrastructure constraints: Linux kernel and host architecture requirements can rule out otherwise suitable environments.
• Scale needs planning: Deployments above 500 nodes require guidance for large environments or specific datapath modes.
• Beta encryption option: ztunnel is marked beta, so teams should be cautious about making it a required production dependency.

Alternatives

Choose Cloudflare Access instead if a freemium access product with broad desktop, mobile, web, and API platforms is a better match; its free plan is capped at under 50 users. Tailscale is another freemium option for teams looking for a product spanning desktop, mobile, and web platforms, with a free Personal plan for up to six users and unlimited user devices. Consider ZeroTier if its freemium networking model and support for self-hosted and multiple client platforms better suit your environment.

Infoblox Cloud Network Automation is a paid alternative for organizations considering token-based cloud network automation. EfficientIP SOLIDserver DDI is a paid option for teams looking at DDI software with hardware and virtual appliances. F5 BIG-IP APM is a paid alternative with a perpetual license option. NetBox offers a freemium choice for teams considering network documentation and management. OpenStack Neutron is another free networking option.

Browse Cloud Network Management Software, Microsegmentation Software, Software-Defined Networking Software, or Container Networking Software for more options by category.

Verdict

Choose Cilium if your team runs compatible Linux workloads and wants networking, fine-grained policy, and observability under one open-source platform. Its breadth and Hubble visibility are the main reasons to choose it; teams that cannot meet the kernel and architecture requirements, or that need a more narrowly scoped or hosted service, should look elsewhere.