Cilium at Ten Years: Stronger Encryption, Safer Policies, and Clearer Visibility for Large Clusters

Cilium 1.19 has been released, marking ten years of development for the eBPF-based networking and security project. There isn’t a flagship feature in this release; instead, it focuses on security hardening, tightening encryption, refining network policy behaviour, and improving scalability for large Kubernetes clusters.

The Cilium post on LinkedIn describes 1.19 as a special release celebrating 10 years since the first commit, with over 2,900 commits from 1,000+ developers. The 2025 annual Cilium report explains how Cilium has quietly become the dominant CNI in production Kubernetes environments, with over 60 per cent of surveyed deployments using Cilium and more than 75 per cent relying on Cilium-based data planes once managed services such as Azure CNI powered by Cilium and GKE Datapath V2 are included.

This position is linked in the report to deliberate technical selection rather than platform defaults, with respondents citing performance, eBPF based observability via Hubble, and advanced policy semantics as the main reasons for adoption, which aligns closely with the emphasis in 1.19 on stricter encryption modes, safer cross cluster defaults and deeper traffic tracing. The report also show that contribution levels have stabilised at around 10,000 pull requests per year, and that Cilium is now the second largest CNCF project by contributions behind only Kubernetes.

A second theme in the report is the extension of Cilium and its related projects into new domains, particularly AI workloads and unified networking across Kubernetes and virtual machines. Large organisations such as Microsoft, Google and TikTok are described as using Cilium to power some of the largest AI training clusters and IPv6 only data centre deployments, while case studies from firms like ESnet and Nutanix highlight the value of consistent observability and policy controls across heterogeneous environments.

The same document positions Tetragon as an emerging runtime security layer, with work on Windows support, persistent enforcement and userspace hook points via uprobes and USDTs, which complements the 1.19 focus on stricter encryption and improved drop attribution in Hubble by moving more enforcement logic into a dedicated security plane.

Security Hardening and Tightening Encryption

The 1.19 release introduces strict modes for both IPsec and WireGuard. This change shifts encryption from a best-effort option to a hard requirement between nodes. In strict mode, unencrypted inter-node traffic is dropped. This satisfies internal policies that financial and public sector environments may have, aiming to remove reliance on implicit trust within a cluster network.

The project’s summary notes that this change is primarily for “regulated or zero trust environments.” LinkedIn discussions frame it as bringing Cilium’s data plane behaviour closer to what security teams expect from modern service meshes. This comes after a longer history of community debate, including a Reddit thread where one user described earlier Cilium architectures as forcing operators to “undermine cluster security” when trying to fit them into strict mTLS models.

This indicates that the project is now responding directly to earlier criticism.

New Beta Integration of Ztunnel

The release has a new beta integration of Ztunnel. Ztunnel enables transparent encryption and authentication of TCP connections between workloads without needing sidecar proxies. In the 1.19 release materials, the maintainers describe how namespaces can be enrolled into Ztunnel so that workloads can gain mutual authentication without application changes, again bringing Cilium closer to service-mesh ideals.

There is an implied rethink of earlier design choices in the decision to disable the existing mutual authentication feature by default and to point users needing mTLS towards the Ztunnel path. Other similar projects, like Istio, still rely on sidecar-based deployment. Comments from practitioners on Reddit emphasise the appeal of lighter-weight approaches that reduce per-pod overhead and configuration complexity, even if they are still in beta.

Improved Policy Behaviour and Scalability

There’s a change in default semantics for multi-clustered setups when network policies do not specify a cluster. In Cilium 1.19.0, such selectors now default to allowing traffic only from the local cluster. This reduces the risk that a misconfigured policy will unintentionally expose services across a Cluster Mesh deployment.

The release also introduces multi-level DNS wildcard matches and the option for Cilium to return ICMPv4 “Destination unreachable” responses when policies deny connections. Together, these aim to make policies both more expressive and easier to debug. Kafka protocol match fields and the ToRequires and FromRequires policy fields have been deprecated to remove underused complexity. This helps operators focus on patterns actually deployed at scale.

From an operational perspective, the promotion of Ztunnel and the changes to policy behaviour and encryption modes are likely to have a significant impact on how Cilium is used in production environments. The shift towards stricter encryption and safer policies is a response to the growing need for more secure and reliable networking and security solutions in cloud-native environments.

The extension of Cilium and its related projects into new domains, particularly AI workloads and unified networking across Kubernetes and virtual machines, is also an important development. This reflects the increasing demand for more flexible and scalable networking and security solutions that can support a wide range of use cases and workloads.

The Cilium project continues to evolve and improve, with a strong focus on security, scalability, and flexibility. The 1.19 release is an important milestone in the project’s history, and it reflects the growing need for more secure and reliable networking and security solutions in cloud-native environments.

As Cilium continues to mature and evolve, it is likely to remain a dominant player in the CNI market, with a strong focus on security, scalability, and flexibility. The project’s commitment to innovation and improvement is likely to continue to drive its growth and adoption in the years to come.

Conclusion

In conclusion, the Cilium 1.19 release is a significant milestone in the project’s history, with a strong focus on security, scalability, and flexibility. The introduction of strict modes for IPsec and WireGuard, the new beta integration of Ztunnel, and the changes to policy behaviour and encryption modes are all important developments that reflect the growing need for more secure and reliable networking and security solutions in cloud-native environments.