We deploy and maintain Kubernetes cluster networking on Cilium — a modern eBPF-based CNI with full security policy, Service Mesh and observability support.
What it covers
- Cilium (CNI) installation with KubeProxyReplacement, clustermesh and routing modes (native/routed/overlay)
- Service networking: ClusterIP, NodePort, LoadBalancer with BGP (via MetalLB) — no kube-proxy
- Network policies (CiliumNetworkPolicy) L3/L4/L7 — zero-trust between pods
- mTLS encryption of node/pod traffic and Ingress/Gateway API integration
- Observability: Hubble (flows, service map), Prometheus metrics, tracing
- Security: IDS (L7 filtering), identity-based networking, DSR (Direct Server Return)
- Migration from an existing CNI (e.g., Calico) without downtime, k8s + egress optimization
We keep the configuration (helm, podCIDR, IPAM, policies) in a GitOps repository and test changes on a staging cluster first.