Cilium vs Open Virtual Network

Cilium is an open-source, cloud-native system for providing, securing, and observing network connectivity between workloads using eBPF. Its networking capabilities include CNI, Layer 4 load balancing, Cluster Mesh, kube-proxy replacement, BGP, service mesh, Gateway API, IPv6, host firewall, and ingress. Network policies can enforce identity-aware rules from L3 through L7, including DNS- and HTTP-aware filtering. Security features include runtime protection and transparent encryption of managed host and endpoint traffic using IPsec, WireGuard, or ztunnel; ztunnel support is marked beta. For visibility, Cilium lists service maps, metrics and tracing export, network flow logs, and protocol visibility. Hubble, built on Cilium and eBPF, provides visibility into service communication and behavior. Documentation describes Prometheus and Grafana integrations and Kubernetes support for services including GKE, AKS, EKS, OpenShift, RKE, k3s, and Alibaba ACK. Its container image requires AMD64 or AArch64 hosts running Linux kernel 5.10 or later, or an equivalent kernel such as 4.18 on RHEL 8.10. For environments above 500 nodes, the quick installation guide directs readers to large-environment guidance or specific datapath modes.

Open Virtual Network (OVN) provides logical networking for virtual machine and container environments, intended for cloud management software. It converts virtual network configurations into OpenFlow and organizes them around logical routers and switches. Listed capabilities include distributed virtual routers and logical switches, access control lists, DHCP, and a DNS server. Tunnels or other encapsulations isolate logical networks from physical and virtual networks, allowing overlapping address spaces. Virtual machines can move between physical machines without network disruption, and gateways connect tunnel-based logical networks to physical networks. Examples of cloud-management integrations include OpenStack Neutron’s ml2/ovn plugin and ovn-kubernetes. OVN runs in userspace, needs no kernel modules, and is written in platform-independent C; its generic build guide covers Linux, FreeBSD, and NetBSD hosts. It is free under the Apache 2 license, with on-premises deployment, a centralized control plane, and a Linux and self-hosted platform listing. OpenSSL libssl is optional but recommended for secure connections to OVN database servers.