eBPF Ambient Service Mesh with Cilium

Points clés

1. Verify kernel support first. Ambient mode needs a recent kernel with eBPF and cgroup v2; older nodes fail silently or fall back to sidecars.
2. Install Cilium with ambient enabled. Use the Helm chart and set routingMode to native or tunnel based on your network.
3. Enroll namespaces selectively. Add the istio.io/dataplane-mode=ambient label only to namespaces ready for mesh traffic.
4. Configure L4 policy first. NetworkPolicy resources enforce identity-based rules before adding L7 HTTP policy.
5. Add L7 policy for sensitive paths. CiliumNetworkPolicy can restrict HTTP methods and paths per service identity.
6. Enable mTLS. Ambient provides wire encryption between nodes; verify with Hubble that traffic is encrypted.
7. Observe with Hubble. Hubble UI and CLI show flows, drops, and policy verdicts without sidecar logs.
8. Plan upgrades carefully. Ambient is newer than sidecar mode; test upgrades in staging and keep a rollback path.

Architecture

Ambient mode splits the data plane into a node-level proxy for L7 processing and eBPF programs in the kernel for L4 routing and policy. Pods carry no sidecar. Traffic is intercepted by eBPF, policy is enforced in kernel, and L7 features are handled by the shared proxy only when needed.

Production configuration

helm repo add cilium https://helm.cilium.io/
helm repo update
helm install cilium cilium/cilium \
  --namespace kube-system \
  --set routingMode=native \
  --set kubeProxyReplacement=true \
  --set ambient.enabled=true \
  --set hubble.relay.enabled=true \
  --set hubble.ui.enabled=true

apiVersion: v1
kind: Namespace
metadata:
  name: payments
  labels:
    istio.io/dataplane-mode: ambient
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-payments-read
  namespace: payments
spec:
  endpointSelector:
    matchLabels:
      app: payments-api
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: web-frontend
    toPorts:
    - ports:
      - port: '8080'
        protocol: TCP
      rules:
        http:
        - method: GET
          path: '/api/v1/payments'

hubble observe --namespace payments --protocol http
hubble observe --namespace payments --verdict DROPPED
cilium status --all-addresses
kubectl get pods -n kube-system -l k8s-app=cilium-envoy

Edge cases from production

• Kernels older than 5.10 lack features ambient requires; the install succeeds but falls back or errors at runtime.
• Native routing requires BGP or direct L3 connectivity between nodes; tunnel mode is safer but adds encapsulation overhead.
• L7 policy increases proxy load; monitor the shared envoy pods and scale them with HPA.
• Mixing sidecar and ambient namespaces in one cluster is supported but complicates policy and debugging.

Questions fréquentes