Testing Cilium Network Policies

Summary

Calico is the current CNI but lacks L7 observability (IP/port only, no HTTP path visibility), so Cilium was evaluated as a replacement with eBPF-based network policies, Hubble observability, and performance benchmarks.

System Context

• •Test cluster: 4 bare-metal nodes, same hardware spec as production
• •Baseline: Calico running, benchmarked with iperf3 + wrk
• •Goal: compare throughput and latency before/after the CNI switch

Checklist

• ☑cilium connectivity test passes 100% before benchmarking
• ☑Compare iperf3 throughput: Cilium vs Calico on the same node
• ☑L7 policy correctly blocks /admin while allowing /api
• ☑Hubble UI shows accurate traffic flow between namespaces

Commands

cilium install --version 1.16.0

cilium connectivity test

cilium hubble enable --ui

kubectl apply -f network-policy-l7.yaml

Conclusion

Cilium's eBPF-based networking delivers 15% better throughput than Calico in our benchmarks. L7 network policies via Envoy proxy add latency but provide essential application-layer security. Hubble is invaluable for debugging.