Cilium vs Isovalent Enterprise for Cilium

Cilium is an open-source, cloud-native system for providing, securing, and observing network connectivity between workloads using eBPF. Its networking capabilities include CNI, Layer 4 load balancing, Cluster Mesh, kube-proxy replacement, BGP, service mesh, Gateway API, IPv6, host firewall, and ingress. Network policies can enforce identity-aware rules from L3 through L7, including DNS- and HTTP-aware filtering. Security features include runtime protection and transparent encryption of managed host and endpoint traffic using IPsec, WireGuard, or ztunnel; ztunnel support is marked beta. For visibility, Cilium lists service maps, metrics and tracing export, network flow logs, and protocol visibility. Hubble, built on Cilium and eBPF, provides visibility into service communication and behavior. Documentation describes Prometheus and Grafana integrations and Kubernetes support for services including GKE, AKS, EKS, OpenShift, RKE, k3s, and Alibaba ACK. Its container image requires AMD64 or AArch64 hosts running Linux kernel 5.10 or later, or an equivalent kernel such as 4.18 on RHEL 8.10. For environments above 500 nodes, the quick installation guide directs readers to large-environment guidance or specific datapath modes.

Isovalent Enterprise for Cilium is a paid, hardened distribution of Cilium, Hubble, and Tetragon, built and supported by Cilium’s creators. Cilium supplies network-layer connectivity and security across multi-cloud and on-premises environments. Enterprise policies include DNS-aware, Layer 7, and deny rules for fine-grained traffic control and micro-segmentation. Hubble provides real-time network-flow visibility, policy visualization, and an interface for troubleshooting and network management. Tetragon adds runtime enforcement and security observability, including protocol enforcement, IP and port whitelisting, and automatic application-aware policy generation. Cluster Mesh connects clusters across AWS, Azure, Google Cloud Platform, and on-premises environments. The product also offers sidecar-free service communication and advanced load balancing. It runs on Linux in self-hosted environments, with hybrid deployment and a distributed control plane. Deployment guidance covers Azure Marketplace, an Azure Resource Manager template, and Azure CLI. Pricing is on request. Hubble UI, DNS Proxy HA, and Tetragon are not enabled by default for AKS creation or upgrades.