---
name: "cilium-ebpf-service-mesh-cni"
description: "Replace iptables kube-proxy with eBPF-powered networking for lightning-fast routing and load balancing."
metadata:
  author: "Cilium"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "install cilium ebpf cni"
  - "replace kube-proxy with cilium"
  - "enable cilium wireguard encryption"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Cilium eBPF CNI & High-Performance Kube-Proxy Replacement

Deploys Cilium CNI: replacing kube-proxy with eBPF host routing (kube-proxy-replacement=true), node-to-node WireGuard/IPsec encryption, Hubble network visibility, and XDP packet processing.

## When to Invoke
Invoke this skill whenever you need to:
- install cilium ebpf cni
- replace kube-proxy with cilium
- enable cilium wireguard encryption

## Execution SOP & Rules
1. Install Cilium via Helm with kubeProxyReplacement=true and k8sServiceHost configuration.
2. Enable encryption: --set encryption.enabled=true --set encryption.type=wireguard.
3. Verify Cilium cluster health: cilium status --wait.
4. Benchmark network throughput and verify packet processing bypasses legacy iptables chains.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.