CIS Cilium Benchmark

This recommendation verifies that Cilium agent is running and healthy on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Cilium agent is running
cilium status
kubectl -n kube-system get pods -l k8s-app=cilium

# Install/upgrade Cilium
helm repo add cilium https://helm.cilium.io/
helm upgrade --install cilium cilium/cilium --namespace kube-system --version 1.15

This recommendation verifies that Cilium RBAC follows least privilege on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Cilium RBAC configuration
kubectl get clusterrole cilium -o yaml
kubectl get clusterrolebinding cilium -o yaml

# Ensure minimal RBAC for Cilium
# Review ClusterRole permissions and remove any unnecessary API group access
# Restrict to required resources: pods, nodes, endpoints, services, ciliumnetworkpolicies

This recommendation verifies that default-deny ingress policy is applied on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify default-deny network policy exists
kubectl get ciliumnetworkpolicy -A
kubectl get ciliumclusterwidenetworkpolicy

# Apply default-deny ingress policy
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  endpointSelector: {}
  ingress:
    - {}

This recommendation verifies that egress policies restrict outbound traffic on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify egress policies are in place
kubectl get ciliumnetworkpolicy -A -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'
cilium policy get

# Apply default-deny egress with DNS allowance
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: default-deny-egress
spec:
  endpointSelector: {}
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: '53'
              protocol: UDP

This recommendation verifies that WireGuard transparent encryption is enabled on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if WireGuard encryption is enabled
cilium config view | grep enable-wireguard
kubectl -n kube-system get configmap cilium-config -o jsonpath='{.data.enable-wireguard}'

# Enable WireGuard transparent encryption
helm upgrade cilium cilium/cilium --namespace kube-system --set encryption.enabled=true --set encryption.type=wireguard

This recommendation verifies that all nodes have active encryption keys on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify node-to-node encryption status
cilium encrypt status
cilium node list

# Ensure all nodes have encryption keys
cilium encrypt status
# If nodes show 'no key', restart Cilium agent:
kubectl -n kube-system delete pod -l k8s-app=cilium

This recommendation verifies that Hubble is enabled for network observability on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Hubble observability status
cilium hubble status
kubectl -n kube-system get pods -l k8s-app=hubble-relay

# Enable Hubble for network observability
helm upgrade cilium cilium/cilium --namespace kube-system --set hubble.enabled=true --set hubble.relay.enabled=true --set hubble.ui.enabled=true

This recommendation verifies that Hubble metrics are exported on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Hubble metrics are exported
cilium hubble metrics list
kubectl -n kube-system get svc hubble-metrics

# Enable Hubble metrics export
helm upgrade cilium cilium/cilium --namespace kube-system \
  --set hubble.metrics.enabled='{dns,drop,tcp,flow,icmp,http}'

This recommendation verifies that host firewall is enabled on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if host firewall is enabled
cilium config view | grep enable-host-firewall
kubectl -n kube-system get configmap cilium-config -o jsonpath='{.data.enable-host-firewall}'

# Enable host firewall
helm upgrade cilium cilium/cilium --namespace kube-system --set hostFirewall.enabled=true

This recommendation verifies that BPF masquerading is configured on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify BPF masquerading is configured
cilium config view | grep enable-bpf-masquerade
cilium bpf nat list

# Enable BPF masquerading (replaces iptables)
helm upgrade cilium cilium/cilium --namespace kube-system --set bpf.masquerade=true

This recommendation verifies that workload identities are properly labeled on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Cilium identity-based security labels
cilium identity list
cilium endpoint list

# Ensure workload identities are properly labeled
kubectl label namespace production app.kubernetes.io/part-of=production
# Verify identity allocation:
cilium identity list | grep -i production

This recommendation verifies that L7 policy enforcement is configured on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify L7 policy enforcement
cilium policy get | grep -A5 'l7Rules'
kubectl get ciliumnetworkpolicy -A -o yaml | grep -A5 'http'

# Configure L7 HTTP-aware policy
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: l7-policy
spec:
  endpointSelector:
    matchLabels:
      app: web
  ingress:
    - toPorts:
        - ports:
            - port: '80'
          rules:
            http:
              - method: GET
                path: '/api/.*'

This recommendation verifies that Cilium is running the latest stable version on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Cilium version
cilium version
kubectl -n kube-system get pods -l k8s-app=cilium -o jsonpath='{.items[0].spec.containers[0].image}'

# Update Cilium to latest stable
helm repo update
helm upgrade cilium cilium/cilium --namespace kube-system --version <latest_stable>

This recommendation verifies that Cilium connectivity tests pass on the Cilium eBPF networking platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cilium eBPF networking platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Cilium health status
cilium status --verbose
cilium connectivity test

# Run Cilium connectivity validation
cilium connectivity test
# Fix any failing tests by reviewing agent logs:
kubectl -n kube-system logs -l k8s-app=cilium --tail=100