Skip to main content

Cilium ENI Mode + Gateway API Deep-dive Configuration

Published 2026-02-14Updated 2026-06-268 min read
info

This document is a deep-dive guide for the Gateway API Adoption Guide. It provides a practical guide for combining Cilium ENI mode with Gateway API for high-performance networking.

Cilium ENI mode is a high-performance networking solution that directly utilizes AWS Elastic Network Interfaces to assign VPC IP addresses to pods. Combined with Gateway API, it achieves both standardized L7 routing and eBPF-based ultra-low latency processing.

1. What is Cilium ENI Mode?โ€‹

Cilium ENI mode directly uses AWS ENI to assign VPC IP addresses to pods. Key features:

  • AWS ENI Direct Use: Each pod receives a real VPC IP, fully integrating with AWS networking (Security Groups, NACLs, VPC Flow Logs)
  • eBPF-based High-Performance Networking: 10x+ performance improvement over iptables with minimal CPU overhead
  • Native Routing: No overlay encapsulation (VXLAN/Geneve), using VPC routing tables directly

2. Architecture Overviewโ€‹

NLB (L4) โ†’ eBPF TPROXY (transparent proxy) โ†’ Cilium Envoy (L7 Gateway) โ†’ Backend Pods (ENI IPs)

Key Componentsโ€‹

  1. NLB: Managed L4 load balancer, microsecond latency
  2. eBPF TPROXY: XDP-level packet interception, lock-free per-CPU processing
  3. Cilium Envoy: L7 processing, HTTPRoute/TLSRoute implementation
  4. Cilium Operator: ENI lifecycle management, IP pool management
  5. Cilium Agent (DaemonSet): eBPF program management, CNI plugin
  6. Hubble: Real-time network flow observability, L7 protocol visibility

3. Prerequisitesโ€‹

โš™๏ธ EKS ํด๋Ÿฌ์Šคํ„ฐ ์š”๊ตฌ์‚ฌํ•ญ
Gateway API ๊ตฌ์ถ•์„ ์œ„ํ•œ ํ•„์ˆ˜ ํ™˜๊ฒฝ ์„ค์ •
EKS ๋ฒ„์ „1.28 ์ด์ƒ (๊ถŒ์žฅ: 1.32)
Gateway API v1.4 ํ˜ธํ™˜์„ฑ
์ปจํŠธ๋กค ํ”Œ๋ ˆ์ธkube-proxy ๋น„ํ™œ์„ฑํ™”
Cilium์ด kube-proxy ๋Œ€์ฒด
๋…ธ๋“œ ์šด์˜์ฒด์ œAmazon Linux 2023 ๋˜๋Š” Ubuntu 22.04
eBPF ์ปค๋„ ์ง€์› ํ•„์š” (5.10+)
์ปจํ…Œ์ด๋„ˆ ๋Ÿฐํƒ€์ž„containerd 1.6+
CRI ํ˜ธํ™˜์„ฑ
VPC CNI ์ œ๊ฑฐํ•„์ˆ˜
Cilium์ด CNI ์—ญํ•  ์ˆ˜ํ–‰

4. Installation Flowโ€‹

For new clusters: disable VPC CNI โ†’ install Gateway API CRDs โ†’ install Cilium via Helm โ†’ create Gateway resources.

For existing clusters: downtime required (5-10 min) for VPC CNI removal and Cilium installation.

5. Gateway API Resource Configurationโ€‹

Standard HTTPRoute, traffic splitting (canary), header-based routing, URL rewrite, and role separation patterns are all supported identically to other Gateway API implementations.

6. Performance Optimizationโ€‹

  • NLB + Cilium Envoy: ~3.5ms total vs ~15ms with ALB+NGINX
  • Prefix Delegation: 16x fewer ENI attach operations
  • BPF tuning: Pre-allocated maps, Maglev load balancing
  • XDP acceleration: 10x packet filtering, 80% CPU reduction for DDoS
โšก ๋ ˆ์ดํ„ด์‹œ ๋น„๊ต ๋ถ„์„
ALB+NGINX vs NLB+Cilium ์„ฑ๋Šฅ ๋น„๊ต
๊ตฌ์„ฑ ์š”์†ŒALB + NGINXNLB + Cilium๊ฐœ์„ ์œจ
L4 ๋กœ๋“œ๋ฐธ๋Ÿฐ์„œALB: 10msNLB: 0.4ms
96%
L7 ํ”„๋ก์‹œNGINX: 5mseBPF+Envoy: 3.1ms
38%
์ด ๋ ˆ์ดํ„ด์‹œ15ms3.5ms
77%
๐Ÿ”„ ๋กœ๋“œ๋ฐธ๋Ÿฐ์‹ฑ ์•Œ๊ณ ๋ฆฌ์ฆ˜ ๋น„๊ต
Cilium์˜ random vs maglev ์•Œ๊ณ ๋ฆฌ์ฆ˜ ํŠน์„ฑ
์•Œ๊ณ ๋ฆฌ์ฆ˜์—ฐ๊ฒฐ ๊ณ ์ •์„ฑ๋ฐฑ์—”๋“œ ์ถ”๊ฐ€ ์‹œ๋ฐฑ์—”๋“œ ์ œ๊ฑฐ ์‹œCPU ์˜ค๋ฒ„ํ—ค๋“œ
random
์—†์Œ์˜ํ–ฅ ์—†์Œ์˜ํ–ฅ ์—†์Œ์ตœ์†Œ
maglev์ถ”์ฒœ
์ตœ๋Œ€ 90%10% ์žฌ๋ฐฐ์น˜์ œ๊ฑฐ๋œ ๋ฐฑ์—”๋“œ ํŠธ๋ž˜ํ”ฝ๋งŒ ์žฌ๋ฐฐ์น˜๋‚ฎ์Œ
๐Ÿ’ป ์ธ์Šคํ„ด์Šค ํƒ€์ž… ๊ถŒ์žฅ์‚ฌํ•ญ
Gateway API ๋…ธ๋“œ ๊ทธ๋ฃน์— ์ตœ์ ํ™”๋œ ์ธ์Šคํ„ด์Šค ์„ ํƒ
์ธ์Šคํ„ด์Šค ํƒ€์ž…vCPU๋ฉ”๋ชจ๋ฆฌ๋„คํŠธ์›Œํฌ ๋Œ€์—ญํญENIIP/ENI๊ถŒ์žฅ ์šฉ๋„
m7g.xlarge416GB
์ตœ๋Œ€ 12.5Gbps
415๋ฒ”์šฉ, ๋น„์šฉ ํšจ์œจ
c7gn.xlarge48GB
์ตœ๋Œ€ 30Gbps
415๊ณ ์„ฑ๋Šฅ ๊ฒŒ์ดํŠธ์›จ์ด
m7g.2xlarge832GB
์ตœ๋Œ€ 15Gbps
415์ค‘๊ทœ๋ชจ ์›Œํฌ๋กœ๋“œ
c7gn.4xlarge1632GB
์ตœ๋Œ€ 50Gbps
830๋Œ€๊ทœ๋ชจ ํŠธ๋ž˜ํ”ฝ
m7g.8xlarge32128GB
25Gbps
830๊ณ ๋ฐ€๋„ ํŒŒ๋“œ
c7gn.12xlarge4896GB
100Gbps
1550์ดˆ๊ณ ์„ฑ๋Šฅ

7. Operations & Observabilityโ€‹

Hubble provides real-time flow observation, service maps, L7 protocol visibility (HTTP, gRPC, Kafka, DNS), and Prometheus metric export.

8. BGP Control Plane v2โ€‹

For hybrid environments needing on-premises to EKS traffic routing via BGP. Not required when using NLB in pure AWS environments.

9. Hybrid Nodes Architecture and AI/ML Workloadsโ€‹

For EKS Hybrid Nodes combining cloud and on-premises GPU nodes, Cilium serves as a unified CNI. Recommended architecture: Cilium CNI + Cilium Gateway API + llm-d for minimized component count with optimal performance.