about

Why Cilera exists

Kubernetes has become the standard platform for cloud-native workloads, and Cilium has become its network layer: a CNCF graduated project, built into Google’s GKE Dataplane V2 and Microsoft’s Azure CNI, and available on Amazon EKS.

As payments, customer data and AI services move onto it, the network Cilium sees is where an attack shows first: a pod reaching somewhere it never has, a DNS lookup that carries data out, a workload that can suddenly be reached from the internet.

What has been missing is someone watching. Hubble records every connection, one cluster at a time, in a short buffer that nobody reads. Network policies allow more than their authors meant, and nothing says where. And when something does go wrong, isolating a workload means writing policy by hand, under pressure, against production.

Cilera closes that gap: full visibility across every cluster, 18 threat rules built for how Cilium works, the blast radius of any workload, and containment in one click when you decide to.

How we build it

• Deep on Cilium, not wide. Cilera does one stack. That is what lets it read Cilium identities, drop reasons and network policies the way Cilium does, instead of treating your cluster as generic network traffic.
• On the Cilium you already run. Open-source Cilium on EKS, GKE, AKS and self-managed clusters, and in preview GKE Dataplane V2, AKS Advanced Container Networking Services, Red Hat OpenShift and Oracle OKE. No new CNI, no enterprise distribution to switch to.
• Your raw flows stay in your cluster. The operator sends aggregated flow counts, network policy specs and workload labels: never packet payloads or the pod IPs of your workloads. HTTP and DNS detail only when you turn it on.
• A person decides. Cilera detects and recommends. Containment is one click, but always a person’s click, and it only ever adds a deny-only policy that is removed when you release it.
• Claims you can check. Our security page lists only what is true of the service today, with independent tests you can run yourself.

Who it is for

• Platform and SRE teams who run Cilium and need to see across clusters, trace a drop to its cause and know what changed.
• Security teams who need detection and a way to contain a compromised workload that does not depend on writing YAML mid-incident.
• Compliance teams who need evidence that segmentation holds, from observed traffic rather than diagrams.