--- title: How k0rdent and Cilium Turn Kubernetes Sprawl into a... description: Platform teams managing large Kubernetes fleets face configuration drift and inconsistency across clusters. k0rdent provides a declarative control plane for... canonical: https://daily.dev/posts/how-k0rdent-and-cilium-turn-kubernetes-sprawl-into-a-platform-xts3683ym twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How k0rdent and Cilium Turn Kubernetes Sprawl into a Platform | daily.dev og:description: Platform teams managing large Kubernetes fleets face configuration drift and inconsistency across clusters. k0rdent provides a declarative control plane for... og:url: https://daily.dev/posts/how-k0rdent-and-cilium-turn-kubernetes-sprawl-into-a-platform-xts3683ym og:image: https://api.daily.dev/og/posts/xTs3683yM.png og:image:alt: How k0rdent and Cilium Turn Kubernetes Sprawl into a Platform og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How k0rdent and Cilium Turn Kubernetes Sprawl into a Platform **[cilium](https://daily.dev/sources/cilium)** · 9 min read · 3 upvotes · 0 comments ## Summary Platform teams managing large Kubernetes fleets face configuration drift and inconsistency across clusters. k0rdent provides a declarative control plane for provisioning and templating cluster fleets, while Cilium (built on eBPF) delivers CNI networking, identity-based security, and L7 observability via Hubble. Together, they let teams bake networking and policy into the cluster definition itself rather than adding them post-deployment. The walkthrough demonstrates deploying a bare-metal cluster via k0rdent's remote-cluster ClusterTemplate with Cilium as the CNI, then applying a CiliumNetworkPolicy that enforces Layer 7 HTTP rules — blocking access to a /private endpoint while allowing /public — without any service mesh or sidecar required. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enforce Layer 7 HTTP path restrictions between pods using Cilium? Use a CiliumNetworkPolicy with an http rules block under toPorts, specifying the allowed method and path. For example, restricting an endpoint selector for app=webapp to only accept GET requests on /public from app=client blocks all other paths and methods, including a /private endpoint, returning an access denied response instead of the underlying data. _Developers locking down service-to-service traffic can find more Cilium policy patterns on daily.dev._ ### How do I disable kube-proxy and use Cilium as a full CNI replacement in a k0s cluster? Set kubeProxy disabled to true in the cluster config, set network.provider to custom with calico set to null, and configure the Cilium service template with kubeProxyReplacement set to "true". This lets Cilium's eBPF datapath take over service routing instead of relying on kube-proxy's iptables-based implementation. _Teams standardizing CNI configuration across clusters track setup details like this on daily.dev._ ### How does k0rdent let platform teams deploy Cilium consistently across many Kubernetes clusters? Cilium is registered in the k0rdent catalog as a validated service template that can be attached to any ClusterDeployment, so every cluster provisioned inherits the same CNI, policy, and observability configuration by default. This removes the need to configure networking by hand on each cluster, reducing drift across a growing fleet spanning cloud, bare metal, and on-prem environments. _Platform teams scaling cluster fleets can follow consistency practices like these via daily.dev._ ## Similar posts on daily.dev - [Kubernetes for platform teams: Leveraging k0s and k0rdent](https://daily.dev/posts/kubernetes-for-platform-teams-leveraging-k0s-and-k0rdent-2tiekdtrt) · CNCF · 0 upvotes · 0 comments - [Zero-Trust Developer Platforms with Cilium Network Policies](https://daily.dev/posts/zero-trust-developer-platforms-with-cilium-network-policies-qpoai8tmf) · cilium · 8 upvotes · 0 comments - [Secure Multitenancy with OpenShift and Isovalent Networking for Kubernetes](https://daily.dev/posts/secure-multitenancy-with-openshift-and-isovalent-networking-for-kubernetes-bm3f03uib) · Isovalent · 1 upvotes · 0 comments - [Mirantis' Kubernetes Management Platform k0rdent Reaches v1.2.0](https://daily.dev/posts/mirantis-kubernetes-management-platform-k0rdent-reaches-v1-2-0-9q1t5raum) · InfoQ · 2 upvotes · 0 comments - [Zero Trust with Cilium : Enforcing mTLS in Kubernetes](https://daily.dev/posts/zero-trust-with-cilium-enforcing-mtls-in-kubernetes-1gbrdwnxf) · Faun · 3 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#kubernetes](https://daily.dev/tags/kubernetes), [#cilium](https://daily.dev/tags/cilium) [View this post on daily.dev](https://daily.dev/posts/how-k0rdent-and-cilium-turn-kubernetes-sprawl-into-a-platform-xts3683ym) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How k0rdent and Cilium Turn Kubernetes Sprawl into a Platform","url":"https://daily.dev/posts/how-k0rdent-and-cilium-turn-kubernetes-sprawl-into-a-platform-xts3683ym","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-k0rdent-and-cilium-turn-kubernetes-sprawl-into-a-platform-xts3683ym"},"datePublished":"2026-07-14T08:52:56.138Z","dateModified":"2026-09-14T08:40:10.426Z","description":"Platform teams managing large Kubernetes fleets face configuration drift and inconsistency across clusters. k0rdent provides a declarative control plane for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e07d6ff5042a68c336a2e6113581ee59?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e07d6ff5042a68c336a2e6113581ee59?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"cilium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"cilium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/95777db1b3254a14a54686a789654d5a","url":"https://daily.dev/sources/cilium"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-k0rdent-and-cilium-turn-kubernetes-sprawl-into-a-platform-xts3683ym","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,kubernetes,cilium","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"cilium","item":"https://daily.dev/sources/cilium"},{"@type":"ListItem","position":3,"name":"How k0rdent and Cilium Turn Kubernetes Sprawl into a Platform"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-k0rdent-and-cilium-turn-kubernetes-sprawl-into-a-platform-xts3683ym#faq","mainEntity":[{"@type":"Question","name":"How do I enforce Layer 7 HTTP path restrictions between pods using Cilium?","acceptedAnswer":{"@type":"Answer","text":"Use a CiliumNetworkPolicy with an http rules block under toPorts, specifying the allowed method and path. For example, restricting an endpoint selector for app=webapp to only accept GET requests on /public from app=client blocks all other paths and methods, including a /private endpoint, returning an access denied response instead of the underlying data. Developers locking down service-to-service traffic can find more Cilium policy patterns on daily.dev."}},{"@type":"Question","name":"How do I disable kube-proxy and use Cilium as a full CNI replacement in a k0s cluster?","acceptedAnswer":{"@type":"Answer","text":"Set kubeProxy disabled to true in the cluster config, set network.provider to custom with calico set to null, and configure the Cilium service template with kubeProxyReplacement set to \"true\". This lets Cilium's eBPF datapath take over service routing instead of relying on kube-proxy's iptables-based implementation. Teams standardizing CNI configuration across clusters track setup details like this on daily.dev."}},{"@type":"Question","name":"How does k0rdent let platform teams deploy Cilium consistently across many Kubernetes clusters?","acceptedAnswer":{"@type":"Answer","text":"Cilium is registered in the k0rdent catalog as a validated service template that can be attached to any ClusterDeployment, so every cluster provisioned inherits the same CNI, policy, and observability configuration by default. This removes the need to configure networking by hand on each cluster, reducing drift across a growing fleet spanning cloud, bare metal, and on-prem environments. Platform teams scaling cluster fleets can follow consistency practices like these via daily.dev."}}]} ```