project
Cilium is an open-source CNI project using eBPF to provide Kubernetes networking, kube-proxy replacement, load balancing, security policy, and observability.
No evidence-backed relationships are recorded.
Tetragon ran inside a CodeBuild GitHub Actions runner and killed /usr/bin/curl when a dependency's postinstall script tried to reach a non-loopback address. The control needs a pinned host kernel and privileged mode.
Reality
A guide rebuilding browser OIDC login off ingress-nginx keeps its Gateway and HTTPRoute objects intact and hands the 401-to-302 step to two Traefik middlewares. Swap the controller and that half gets rewritten.
Reality
On a kind cluster where kube-proxy was never installed, Cilium 1.17.3 forwards Services with no KUBE-SERVICES chain at all, so the grep that returns 13 rules elsewhere returns nothing while the app stays up.
Reality
The release jumps two Gateway API minor versions to v1.6 and adds ExternalAuth, CORS filters, ListenerSets and non-HTTP route types. What is left of the case for a separate ingress tier is the annotations you cannot port.
Reality
Cilium 1.19 puts routing, mTLS and observability in one eBPF program per node, with a single Envoy per node for Layer 7. The 100 GB of RAM the post says that frees assumes 1,000 pods at the top of the sidecar range.
Reality
The GitOps tooling worked, and seven services still went back to Docker Compose in a day, because the operator consumes every one of those images and cuts release tags for none of them.
Reality
Helm charts and container images keep working after March 2026, but the patch stream stops, and the recommended replacement is a specification rather than software, so every team now picks its own controller.
Reality
Adyen traced sandbox setup failures on its big data clusters to a garbage collector that walks every tracked connection in order, which turns the table-size knob you raised for headroom into part of the fault.
Reality
Google's preview cluster-scoped policy gives platform teams a rule namespace owners cannot override. What it does not give them is a cluster that denies by default.
Reality
One operator flipped Cilium to full kube-proxy replacement and woke at 2:47 AM to a SIEM ingesting zero events. The cluster was healthy. The evidence pipeline was not.
Reality
A tutorial walkthrough of kube-proxy is a useful reminder that a ClusterIP is not an interface. The iptables-to-IPVS-to-eBPF sequence is an answer to per-node rule accounting, not taste.
Reality
A nine-hour Istio Ambient debugging session ended with an agent recommending its own retirement. The edits were fine. The verification step is where the loop ran out of hypotheses it could see.
Reality
A CNCF post argues the EU Data Act, NIS-2, DORA and the UK DUAA force platform teams to show isolation across control, runtime, build and observability planes, not just a region.
Reality
A CNCF blog account reports a self-upgrading K3s control plane on Kairos with etcd quorum intact. The instructive part is that both bugs were in the automation, not the OS.
Reality