aicoolies logo
Cilium logo
Cilium logo

Cilium

eBPF-based networking, security, and observability for Kubernetes

open sourceupdated Aug 16, 2026

Cilium is a CNCF Graduated, Apache-2.0 project for Kubernetes networking, security, and observability using eBPF. It can replace kube-proxy, enforce identity-aware L3-L7 network policies, and add Hubble flow observability plus Tetragon runtime-security signals. Current source checks support GKE Dataplane V2 using Cilium/eBPF and Azure CNI Powered by Cilium for AKS.

Read our Cilium review

A detailed review by the aicoolies team — click to read

Cilium is a CNCF Graduated Kubernetes networking, security, and observability project that uses eBPF to move datapath, policy, and visibility logic closer to the Linux kernel. The project is Apache-2.0, active on GitHub with 24K+ stars, and documented around Cilium 1.19.x at the time of this update. Its core value is giving Kubernetes teams an eBPF-based alternative to older iptables-heavy networking and policy paths.

The source-backed cloud story should be precise. Google Cloud documentation says GKE Dataplane V2 is implemented using Cilium and eBPF and is enabled by default for new Autopilot clusters, while Microsoft documents Azure CNI Powered by Cilium for AKS. Those facts are stronger and safer than broad claims that every major cloud provider has made Cilium the default networking layer in every Kubernetes offering.

Cilium’s surrounding ecosystem adds Hubble for flow observability, Tetragon for runtime-security observability and enforcement, Cluster Mesh for multi-cluster connectivity, and service-mesh-adjacent features such as mutual TLS, Gateway API integration, and Layer 7 protocol visibility. Teams should still plan migrations carefully and keep dedicated service-mesh platforms in scope when they need advanced L7 traffic management.

Pricing

Free and open-source under Apache 2.0

Platforms

Linux, Kubernetes, Helm installation

Categories

Tags

Use Cases

Related Tools

computed discovery: shared active categories · kept separate from editor-verified Alternatives

KTransformers parent kvcache-ai logo

KTransformers

Heterogeneous CPU-GPU inference and SFT for large MoE models

Open-source framework for running and fine-tuning large Mixture-of-Experts models with heterogeneous CPU-GPU execution, optimized kernels, limited VRAM and SGLang or LLaMA-Factory integrations.

Open Source
vLLM Production Stack parent vLLM logo

vLLM Production Stack

Official Kubernetes and Helm reference stack built on the vLLM inference engine

Official vLLM reference implementation for scaling the existing inference engine on Kubernetes with Helm, request routing, KV-cache offload, autoscaling and Prometheus/Grafana observability.

Open Source
Dynamo logo

NVIDIA Dynamo

Distributed inference orchestration above vLLM, SGLang and TensorRT-LLM

Open-source, datacenter-scale orchestration layer that coordinates vLLM, SGLang and TensorRT-LLM across nodes with disaggregated serving, KV-aware routing, multi-tier cache management and automatic scaling.

Open Source
GPUStack logo

GPUStack

Open-source GPU control plane for scalable AI model serving

Open-source GPU cluster manager that configures vLLM, SGLang, TensorRT-LLM or custom engines, serves models through compatible APIs, and provisions SSH-accessible GPU instances across on-premises, Kubernetes and cloud environments.

Open Source
Mooncake logo

Mooncake

Disaggregated KV cache storage and transfer for LLM serving

Open-source infrastructure for disaggregated LLM serving that pools KV caches across prefill and decode workers, with high-performance transfer, distributed storage and integrations for vLLM and SGLang.

Open Source
ToolHive mascot logo

ToolHive

Run and govern MCP servers across desktop, CLI and Kubernetes

Open-source MCP runtime and governance platform that runs servers in isolated containers, curates registries, enforces access policies, and operates gateways across desktop, CLI, and Kubernetes.

Open Source

Used in Stacks

Comparisons

Cilium vs Istio — eBPF Kernel-Level Networking vs Envoy Sidecar Service Mesh

Cilium and Istio both manage Kubernetes service-to-service communication but use fundamentally different architectural approaches. Cilium leverages eBPF programs in the Linux kernel to handle networking, security, and observability without user-space proxies. Istio deploys Envoy sidecar proxies alongside each pod for traffic management, mutual TLS, and fine-grained routing with deep Layer 7 protocol awareness.

CiliumIstio

FAQ

What is Cilium?

Cilium is a CNCF Graduated, Apache-2.0 project for Kubernetes networking, security, and observability using eBPF. It can replace kube-proxy, enforce identity-aware L3-L7 network policies, and add Hubble flow observability plus Tetragon runtime-security signals. Current source checks support GKE Dataplane V2 using Cilium/eBPF and Azure CNI Powered by Cilium for AKS.

Is Cilium free?

Yes — Cilium is open source and free to use. Free and open-source under Apache 2.0

Is Cilium open source?

Yes — Cilium is open source.

What are the best Cilium alternatives?

The top editor-verified Cilium alternatives are Coroot, k0s.

How does Cilium score in our review?

Our hands-on review scores Cilium 93/100 overall, based on speed, privacy, and developer-experience testing.