Learn Cilium - L7 Policy & API-Aware Security

#Introduction

So far all of our policies have worked at the network level: labels, ports, and protocols. Episode 13 changes that level to the application layer (L7). With L7 policies, Cilium understands the contents of traffic — which HTTP method is used, which path is accessed, or which Kafka topic is consumed — and decides permissions based on that content.

Why does this matter? Because ports alone are not enough. An application serving HTTP on port 8080 may need to accept GET /public but reject POST /admin. Port-based policies cannot tell the difference; L7 policies can. This episode also introduces CiliumClusterwideNetworkPolicy for policies that apply across namespaces.

#L7 Proxy and Visibility

To inspect L7 content, Cilium uses an L7 proxy (Envoy-based) that is automatically attached to endpoints with L7 policies. Traffic entering an endpoint with an L7 policy is directed to this proxy, inspected, and forwarded only if it matches the rules. Without an L7 policy, the L7 proxy is inactive and traffic flows directly in the dataplane.

The L7 proxy is enabled by default in modern Cilium. Verify its status:

cilium status | grep -i envoy

cilium status | grep -i envoy shows the status of the Envoy component that powers the L7 proxy. If it is not active, enable it with --set l7Proxy=true at install time.

#HTTP, gRPC, and Kafka Rules

L7 rules are written in an ingress or egress block with a rules field. For HTTP, specify the allowed methods and paths:

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: l7-http
spec:
  endpointSelector:
    matchLabels:
      app: api-server
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: web
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: GET
                path: "/public"

rules.http with method: GET and path: /public means only GET requests to /public are accepted from pods labeled web. All other methods and paths will be rejected by the L7 proxy. Similar rules exist for grpc (matching a service and method) and kafka (matching a topic and produce/consume operations):

rules:
  grpc:
    - service: "/payment.PaymentService/"
      method: "/payment.PaymentService/Charge"
  kafka:
    - apiKey: produce
      topic: "orders"

rules.grpc restricts gRPC calls to a specific service and method, while rules.kafka restricts produce operations to a specific topic. Both use protocol content, not just ports.

#CiliumClusterwideNetworkPolicy

So far a CNP has always been scoped to a single namespace. For policies that apply across namespaces, use CiliumClusterwideNetworkPolicy (CCNP). Its structure is identical, but spec.endpointSelector can select pods in all namespaces at once. Here is an example policy that denies access to a debug port from all pods except the monitor:

apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: blokir-debug-port
spec:
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: monitor
      toPorts:
        - ports:
            - port: "9229"
              protocol: TCP

matchLabels: {} here selects all endpoints across the entire cluster — in YAML, an empty object is a selector that matches everything. With this policy, port 9229 can only be reached from pods labeled app=monitor, regardless of namespace.

#L7 Policy in Practice

After writing a policy, apply it and observe the results with Hubble, which shows L7 details on flows:

kubectl apply -f l7-http.yaml
hubble observe --protocol http

hubble observe --protocol http displays complete HTTP flows with the method, path, and status code. Flows rejected by L7 will appear with a DROPPED verdict and the associated proxy drop reason. This is the most direct way to confirm the GET /public rule works and that POST /admin is truly blocked.

#Closing

Key takeaways:

• L7 policies work through the Envoy-based L7 proxy that understands application content.
• http rules match methods and paths; grpc rules match services and methods.
• kafka rules restrict topics and produce or consume operations.
• A CCNP applies across namespaces with apiVersion: cilium.io/v2.
• hubble observe --protocol http shows L7 flow details.
• L7 policies have overhead; use them selectively on critical endpoints.

In the next episode 14, we will cover encryption and zero trust networking — transparent native WireGuard, IPsec as an alternative, inter-node encryption without changing workloads, and verification with Hubble and cilium encrypt status. This closes the biggest gap in multi-node clusters: inter-node traffic that flows in plaintext across the network.