Cilium 1.19 replaces the per-pod Envoy with one eBPF program per node

The kube-proxy replacement is where the post's biggest number sits: up to 100 times the performance of iptables with thousands of services ^[7]. The post explains this as a data structure swap. Cilium keeps service state in BPF maps, which are hash tables with O(1) lookup, while iptables walks its rules linearly ^[8]. Linear cost scales with the rule count, so the ratio between the two closes as the Service count falls ^[9]. For the figure to transfer you need thousands of Services in one cluster and enough packet rate that service lookup sits on the hot path.

What a platform team takes on is the loader. Every eBPF program passes a kernel verifier before it runs, and only programs guaranteed not to crash or loop forever are JIT-compiled to native machine code ^[5]. Kernel side and userspace side share state through BPF maps, which both can read and write at once ^[6]. Verification happens at load, so an agent or policy that fails, fails at rollout.

The mTLS change is the one the post puts numbers on. Cilium 1.19, presented at KubeCon EU 2026 in Amsterdam, drops the injected Envoy per pod (roughly 50 to 100 MB of RAM each) and runs one eBPF program per node covering routing, mTLS and observability for every pod on it ^[12][13]. Layer 7 features still need a proxy, so one Envoy runs per node ^[14]. That per-node Envoy is what enforces a CiliumNetworkPolicy written down to HTTP method and path, such as GET on /api/.* ^[11]. The post's saving is 1,000 pods times 100 MB, or 100 GB reserved for proxy infrastructure ^[15]. At the bottom of its own range the same cluster is 50 GB ^[1]. The replacement cost tracks node count: 1,000 pods at 50 per node needs 20 node-level Envoys, and the same 1,000 pods at 10 per node needs 100 ^[2].

OpenTelemetry eBPF Instrumentation, released in beta by Splunk at the same event, reads telemetry out of the kernel with no code change, no service restart and no sidecar agent ^[16]. That is aimed at Go, Rust and C++ binaries and at legacy applications where changing the source is hard or impossible ^[17]. The post says evaluations typically uncover 15 to 40 percent of cluster traffic that distributed tracing could not see ^[19]. That range is traffic nobody instrumented. OBI integrates with existing OpenTelemetry SDKs and does not duplicate data from services already instrumented ^[18], so a fleet already emitting spans from everything has nothing for it to find.

Tetragon detects policy violations and enforces them in the kernel. The post's example detects /bin/bash or /bin/sh running in pods without CAP_SYS_ADMIN and terminates the process with SIGKILL in real time ^[20]. The published TracingPolicy attaches a kprobe to security_bprm_check, reads argument 0 as a linux_binprm, and matches binaries with an In operator over /usr/bin/sudo and /bin/su ^[21]. Matching is on the binary path. Any process whose executable sits at a listed path is a match, so an image that ships a legitimate tool at that path gets killed by the kernel before userspace sees anything ^[3].

On how much of this arrives whether or not you picked it: the 67 percent figure is attributed to the CNCF Annual Cloud Native Survey 2026, and the post does not give the sample or the question wording ^[22]. Its account of Cilium's status is not consistent either. One paragraph calls Cilium the standard network plugin for GKE, EKS and AKS ^[2]; another describes it as "shipped as a standard option or even as the default in GKE, EKS, and AKS" ^[3].