Key features
- eBPF data plane — kernel-level networking replacing iptables for APAC high-throughput Kubernetes clusters
- L7 network policies — HTTP, gRPC, Kafka protocol-aware APAC microservice access control
- Hubble observability — real-time APAC network topology, flow logs, and DNS/HTTP traces
- WireGuard encryption — transparent pod-to-pod encryption without APAC service mesh or app changes
- Cluster mesh — cross-cluster APAC service discovery and policy enforcement for multi-cluster deployments
- BGP routing — native BGP for APAC load balancer and service IP advertisement to upstream routers
- CNCF graduation — production-ready for APAC enterprise Kubernetes with AWS, GCP, Azure CNI support
Best for
- APAC platform engineering teams running high-traffic Kubernetes clusters (10K+ pods) where iptables-based CNI performance degradation is measurable and Cilium's eBPF model provides significant throughput and CPU improvements
- Engineering organisations with APAC zero-trust network security requirements where L3/L4 network policies are insufficient and L7 protocol-aware policies are needed for APAC microservice-to-microservice access control without a full service mesh
- APAC regulated-industry platform teams that need encryption-in-transit for all pod-to-pod Kubernetes traffic as a network-layer requirement without deploying Istio or Linkerd service mesh infrastructure
- APAC multi-cluster Kubernetes platform teams using Cilium Cluster Mesh for cross-cluster service discovery and unified network policy enforcement across APAC dev/staging/production cluster topologies
Limitations to know
- ! Linux kernel version requirement — Cilium requires Linux kernel ≥4.19 for full eBPF feature support and ≥5.10 for WireGuard encryption; APAC teams on older OS distributions (RHEL 7, older Ubuntu LTS) must upgrade the OS before adopting Cilium
- ! Operational complexity vs simpler CNIs — Cilium's eBPF kernel integration adds operational complexity compared to Flannel or Calico; APAC platform teams should invest in Cilium training before production deployment and maintain kernel-aware debugging skills
- ! Migration from existing CNI — replacing an existing APAC Kubernetes CNI (Calico, Flannel) with Cilium in production requires a full cluster migration or node-by-node rolling replacement; APAC platform teams should test Cilium migration in a staging cluster before production migration
- ! Hubble storage for APAC large clusters — Hubble flow logs at APAC production network volumes require significant storage allocation for historical flow retention; APAC teams enabling Hubble on large clusters should allocate dedicated Hubble storage and configure flow retention TTLs
About Cilium
Cilium is a CNCF-graduated open-source Kubernetes CNI (Container Network Interface) and network security platform that uses Linux eBPF (extended Berkeley Packet Filter) kernel technology to provide APAC platform engineering teams with high-performance Kubernetes networking, granular L3/L4/L7 network policies, transparent WireGuard encryption, and deep network observability — replacing traditional iptables-based CNIs (Calico, Flannel, WeaveNet) for APAC Kubernetes clusters with stringent performance, security, or observability requirements.
Cilium's eBPF data plane — where Cilium programs the Linux kernel with eBPF programs that intercept and process network packets at the kernel level, bypassing iptables entirely — provides APAC Kubernetes clusters with significantly higher network throughput and lower latency than iptables-based CNIs, particularly at scale (clusters with thousands of pods where iptables rules grow linearly with pod count, creating O(n) lookup overhead that Cilium's eBPF hash table model replaces with O(1) lookups).
Cilium's L7 network policy model — where APAC platform teams define network policies that enforce at the HTTP, gRPC, Kafka, and DNS protocol level (allowing HTTP GET /api/v1/products but denying HTTP DELETE, allowing Kafka consumer group A but denying group B) rather than just IP and port — enables APAC platform engineering teams to implement fine-grained APAC microservice-to-microservice access control that traditional L3/L4 policies cannot express, reducing the attack surface of APAC internal APIs without modifying application code.
Cilium's Hubble network observability platform — where Cilium's eBPF data plane captures all network flows and exposes them through the Hubble API and Hubble UI as a real-time network topology map showing APAC pod-to-pod communication, DNS resolution, HTTP request traces, and network policy drops — provides APAC platform engineers with the network-level visibility that is typically invisible in Kubernetes deployments, enabling debugging of APAC microservice communication failures and network policy misconfigurations without tcpdump access.
Cilium's transparent WireGuard encryption — where Cilium automatically encrypts all pod-to-pod traffic in transit using WireGuard without requiring APAC application or service mesh changes — enables APAC platform teams to enforce encryption-in-transit for all Kubernetes workload communication as a network-layer guarantee, satisfying APAC financial services and healthcare data protection requirements without modifying application TLS configuration or deploying a service mesh like Istio.
Beyond this tool
Where this category meets practice depth.
A tool only matters in context. Browse the service pillars that operationalise it, the industries where it ships, and the Asian markets where AIMenta runs adoption programs.
Other service pillars
By industry