Traditional IP-based firewalls are inadequate for Kubernetes environments where pod IPs are ephemeral and workloads are constantly rescheduled. This guide covers how Cilium uses eBPF to enforce identity-based network security directly in the Linux kernel, replacing volatile IP rules with policies tied to Kubernetes labels, namespaces, and service accounts. Key topics include: the limitations of iptables/IPVS (O(n) complexity vs eBPF's O(1)), Layer 7 policy enforcement for API-aware controls (allowing GET /items while blocking POST /admin/shutdown), microsegmentation with default-deny posture, transparent encryption via IPsec or WireGuard, mutual TLS with ztunnel, host-layer segmentation, and Day 2 observability through Hubble's service maps and flow logs. Compliance use cases for SOC2, PCI-DSS, and GDPR are also addressed via Tetragon runtime security.
