A customized Envoy proxy with Cilium filters for enforcing L7 network policies in Kubernetes clusters.
Cilium Proxy is a customized version of the Envoy proxy that includes Cilium-specific filters for enforcing Layer 7 network policies in Kubernetes clusters. It solves the problem of applying fine-grained security rules—such as those based on HTTP methods, paths, or headers—to traffic between pods, going beyond traditional IP/port-based policies.
Platform engineers, SREs, and DevOps professionals managing Kubernetes clusters with Cilium who need advanced L7 traffic control and security policy enforcement.
Developers choose Cilium Proxy because it integrates seamlessly with Cilium's networking and security layer, providing a production-ready, performant proxy tailored for Kubernetes environments without the overhead of maintaining a fully custom proxy solution.
Envoy with Cilium filters
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Directly enforces CiliumNetworkPolicy with L7 rules like HTTP methods and paths, enabling fine-grained security without extra configuration layers.
Adds only Cilium-specific filters to Envoy, maintaining performance and reliability while minimizing overhead.
Builds for amd64 and arm64, with specific compilation flags for Raspberry Pi, allowing deployment on diverse hardware including edge devices.
Designed as the host proxy for Cilium, ensuring compatibility and integration in production Kubernetes clusters for pod-to-pod communication.
Building requires Docker Buildkit, Bazel, and specific environment variables; it can take over an hour and often faces memory issues, necessitating job limits and cache management.
Only useful within Cilium; not a standalone proxy and lacks functionality without Cilium, limiting flexibility for general use cases.
Strict compatibility matrix with Envoy and Cilium versions complicates upgrades and maintenance, as updates must be synchronized across projects.