shouldiuse.io

Categories

VERDICT

Should I use Cilium?

eBPF-based Networking, Observability, and Security for Kubernetes - cilium.io

Depends. Buy if you run serious Kubernetes at scale and have platform engineers — the open-source core is free and battle-tested. Skip it if you run small clusters or no Kubernetes; default networking or a simpler CNI will do.

Confidence

Medium. Based on ~40 public sources; many snippets truncated and enterprise pricing unconfirmed.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Open-source core

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Isovalent Enterprise for Cilium~$600/node (reported, unconfirmed)

Best for

  • Large Kubernetes fleets
  • Platform teams replacing kube-proxy
  • Zero-trust network security
  • Telcos and data center operators

Not for

  • Non-Kubernetes shops — nothing here to network
  • Small clusters happy with default CNI; complexity outweighs gains
  • Teams without eBPF/Linux depth to debug it
  • Guess: older kernels — eBPF needs modern Linux

Gotchas - check before you buy

high

Kube-proxy replacement is a real migration, not a toggle — node readiness delays reported

medium

Per-node enterprise pricing compounds fast at fleet scale (~$600/node reported, unconfirmed)

medium

Enterprise-grade features live in the paid Isovalent distribution, not the free core

medium

Advanced policies are powerful but misconfiguration is a documented failure mode

Pros and cons

Pros

  • Open-source core, free to self-host
  • Networking, observability, and security combined via eBPF
  • Replaces kube-proxy for documented performance gains
  • Proven at scale: AWS EKS Anywhere and Kakao adopt it
  • Network policies go well beyond Kubernetes defaults

Cons

  • Complex; one practitioner's writeup is literally titled a 'labyrinth'
  • Enterprise support runs ~$600/node per Reddit reports
  • Kube-proxy replacement migration can delay node readiness
  • Steady CVE stream demands prompt patching discipline
  • Power depends on correct policy config; easy to misconfigure

Sources & method

Analyzed 10/05/2026 - 8 sources - Active open-source project publishing advisories and a threat model; multiple CVEs require timely patching.

official x3review x3security x2
  • DoS via Kubernetes annotations in specific configurations (GHSA-24m5-r6hv-ccgp), Cilium agent can crash under specific configs; existing traffic affected.
  • Pod label updates could bypass policy (CVE-2023-39347), Users with pod-update rights could bypass policy, per GitLab advisory.
  • Sensitive info disclosure via local Envoy admin socket (CVE-2026-49445), Local access to the Envoy admin socket can expose data and disrupt the cluster.
  • Information exposure in cilium bugtool output (CVE-2026-41520), Bugtool output could leak sensitive information.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 8

    Sources

  • Analyzed

  • Value for money: 5/5. Free open-source core; pay only for enterprise support
  • Ease of use: 3/5. Documented as a 'labyrinth' even by fans
  • Feature depth: 5/5. Networking, observability, security, kube-proxy replacement in one
  • Support quality: 3/5. Community Slack plus paid Isovalent enterprise support
  • Security posture: 4/5. Transparent advisories and published threat model; steady CVE stream
  • 1,624 Companies tracked using it per TheirStack data
  • ~$600/node Reported enterprise price Reddit-reported Isovalent base, unconfirmed
  • Yes Free tier open-source core via cilium.io
  • CNCF project Governance open source, Linux Foundation

Pricing

Open-source core

Free

  • eBPF networking and load balancing
  • Hubble observability
  • Network policies and kube-proxy replacement

Isovalent Enterprise for Cilium

~$600/node (reported, unconfirmed)

  • Enterprise support and SLAs
  • Hardened enterprise distribution
  • Compliance-focused features

Security

Active open-source project publishing advisories and a threat model; multiple CVEs require timely patching.

  • DoS via Kubernetes annotations in specific configurations (GHSA-24m5-r6hv-ccgp)Cilium agent can crash under specific configs; existing traffic affected.⁷
  • Pod label updates could bypass policy (CVE-2023-39347)Users with pod-update rights could bypass policy, per GitLab advisory.
  • Sensitive info disclosure via local Envoy admin socket (CVE-2026-49445)Local access to the Envoy admin socket can expose data and disrupt the cluster.
  • Information exposure in cilium bugtool output (CVE-2026-41520)Bugtool output could leak sensitive information.

What users say

Practitioner threads describe Cilium as the powerful, increasingly default eBPF networking choice for Kubernetes, with recurring friction around complexity and kube-proxy migration.

Alternatives

Compare Cilium with each alternative.

  • Calico

    The classic CNI rival; simpler to operate, huge ecosystem

    Cilium vs Calico

  • Flannel

    Dead-simple CNI for small clusters; skip advanced security features

    Cilium vs Flannel

  • Default Kubernetes CNI + kube-proxy

    Native networking is fine until you genuinely need eBPF features

Companies that use it

  • Kakao⁴
  • AWS (EKS Anywhere)
  • DigitalOcean (managed Kubernetes)
  • Preferred Networks
Full analysis

Based on ~40 public sources; many snippets truncated and enterprise pricing unconfirmed.

Free, powerful eBPF networking for serious Kubernetes. Overkill — and useless — if you're not running K8s at scale.

Methodology

Based on ~40 public sources; many snippets truncated and enterprise pricing unconfirmed.

Sources

  1. Cilium — official sitecilium.io
    official
  2. Cilium enterprise distributionscilium.io
    official
  3. On-prem Cilium enterprise costs (Reddit)reddit.com
    review
  4. Kakao CNCF case studycncf.io
    official
  5. Cilium vs Calico guidetigera.io
    review
  6. Cilium product security pagecilium.io
    security
  7. GHSA-24m5-r6hv-ccgp advisorygithub.com
    security
  8. Companies using Cilium (TheirStack)theirstack.com
    review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.