Cilium

Cilium is an open-source platform for connecting, securing, and observing network traffic between workloads. It is best suited to teams operating Linux-based, self-hosted environments that need fine-grained policy and network visibility. Its breadth is compelling, but Linux kernel compatibility and cluster scale are important constraints.

Overview

Rather than focusing only on connectivity, Cilium brings networking, policy enforcement, and observability together using eBPF. Its hybrid deployment and control-plane models, policy segmentation, and northbound API make it relevant to teams managing network rules across workloads. This is a substantial platform choice, not simply a lightweight network plugin; teams seeking only basic connectivity may not need its full scope.

Its networking use cases include CNI, Layer 4 load balancing, Cluster Mesh, kube-proxy replacement, BGP, service mesh, Gateway API, IPv6, host firewall, and ingress. That range can accommodate varied cluster networking needs, while requiring teams to assess the fit with their existing Linux and Kubernetes environments.

Key features

Policy and security

Cilium policies enforce identity-aware rules from L3 through L7, including DNS- and HTTP-aware filtering. This is useful when controls need to reflect workload identity and application traffic, rather than relying only on broad network boundaries. Security capabilities also include runtime security and transparent encryption.

Encryption covers managed host and endpoint traffic using IPsec, WireGuard, or ztunnel. The ztunnel option is beta, so teams evaluating encryption should account for that maturity distinction rather than treating all three choices alike.

Observability

Hubble, Cilium's distributed networking and security observability platform, provides visibility into service communication and behavior. Cilium also offers service maps, metrics and tracing export, identity-aware L3/L4/DNS flow logs, and advanced protocol visibility. Prometheus and Grafana integrations support metrics and dashboards. This combination can help operators inspect traffic and investigate behavior alongside policy, though it makes most sense for teams prepared to operate the broader platform.

Kubernetes and protocols

The installation guide covers Kubernetes distributions and services including GKE, AKS, EKS, OpenShift, RKE, k3s, and Alibaba ACK. Supported protocols include TCP, UDP, ICMP, ICMPv6, HTTP, DNS, and gRPC. The range is useful for varied cluster environments, but does not remove the underlying host requirements.

Pricing

Cilium is free and open source. The Cilium plan costs nothing and requires Linux kernel 5.10 or an equivalent kernel, on AMD64 or AArch64. There are no paid tiers or seat limits in the plan details. Teams should weigh the no-license-cost model against the operational commitment of running self-hosted infrastructure.

Platforms

Cilium runs on Linux and is self-hosted. Its container image requires AMD64 or AArch64 hosts with Linux kernel 5.10 or later; RHEL 8.10's 4.18 kernel is given as an equivalent. Teams on other architectures or incompatible kernels should not assume they can deploy it. Environments larger than 500 nodes should follow the large-environment guidance or use specific datapath modes, making scale planning part of adoption.

Who it's for

Cilium is a strong fit for platform and security teams that need workload networking, identity-aware policy, and traffic visibility in Kubernetes environments, and can manage Linux-based self-hosted software. It is less suited to teams that want a hosted service, have hosts outside the stated architecture and kernel requirements, or need only a basic network plugin.

Pros and cons

Pros

• Networking, policy, and observability share one platform, useful for teams that want to manage these concerns together.
• L3–L7 identity-aware policies, including DNS- and HTTP-aware filtering, provide application-level control.
• Hubble, flow logs, service maps, and metrics and tracing export support investigation of service behavior.
• Free and open source, with integrations for Prometheus and Grafana and documentation covering major Kubernetes distributions.

Cons

• Linux kernel and architecture requirements rule out some hosts and make compatibility a prerequisite.
• Deployments above 500 nodes need additional large-environment guidance or specific datapath modes.
• ztunnel encryption support is beta, so it is not on the same maturity footing as the other named encryption options.
• Its broad scope may be more than teams need when basic connectivity is the only requirement.

Alternatives

Container Networking Software, Software-Defined Networking Software, Microsegmentation Software, and Cloud Network Management Software are relevant categories for comparing options.

• Calico Open Source is a free Linux, self-hosted, and Windows option with community-driven support and maintenance, in-memory data retention, and unlimited clusters.
• Antrea is a free alternative for Linux, self-hosted, and Windows environments, but requires a Kubernetes cluster and the Open vSwitch kernel module on every Kubernetes node.
• OVN-Kubernetes is another free option for Linux, self-hosted, and Windows environments.
• Kube-OVN is a free, Apache-2.0 licensed Kubernetes networking project for Linux and self-hosted use.
• Flannel is a free, Apache 2.0 licensed option for Linux, self-hosted, and Windows environments.
• Calico Enterprise is a paid option for teams comparing enterprise offerings; its pricing is custom.
• Spiderpool is a free, Apache License 2.0 Kubernetes networking solution for Linux and self-hosted use.
• Amazon VPC CNI is a free option for Linux, self-hosted, and Windows environments.

Verdict

Choose Cilium if your team needs networking, fine-grained workload policy, and observability together and can meet its Linux kernel and architecture requirements. Its strongest reason to choose it is that breadth; look elsewhere if you want a hosted service, need incompatible hosts, or only need basic connectivity.