Cilium is a Kubernetes-native networking, observability, and security solution built on eBPF. It provides CNI plugin functionality with overlay/native routing modes, distributed load balancing (replacing kube-proxy), cluster mesh for multi-cluster connectivity, identity-based network policies (L3-L7), service mesh with mutual authentication, and observability via Hubble (flow metrics, DNS insights). The architecture features a modular design using the Hive dependency injection framework, with components including the cilium-agent daemon, operator for CRD management, CLI tools for management/debugging, and API servers for inter-component communication. The data plane leverages eBPF/XDP for high-performance packet processing, while the control plane integrates deeply with Kubernetes through client-go, controller-runtime, and custom resource definitions.
Proxyline is a Node.js library that installs a process-wide proxy routing policy across `node:http`, `node:https`, undici/fetch, WebSocket clients, and explicit HTTP CONNECT tunnels. It provides two modes: `managed` (fail-closed with a required proxy URL) and `ambient` (respects `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` environment variables). The library patches global HTTP(S) methods, replaces global agents, installs a custom undici dispatcher, and patches fetch globals. It includes observability via `explain()` and lifecycle events, scoped proxy TLS trust, dynamic bypass registrations, and credential-safe URL redaction. The codebase is TypeScript, ESM-only, and requires Node.js 22.19+ with undici 8.5+ as a peer dependency. It is well-tested with an in-process proxy lab and has comprehensive documentation.
This repository implements a Kubernetes operator for managing egress traffic in Kubernetes clusters. It provides stable egress IP addresses for pods through a control plane/data plane architecture consisting of a controller (managing cluster state via custom resources) and an agent (applying network configuration on each node). The system uses VXLAN tunneling to encapsulate traffic between nodes and employs iptables/IP sets for policy enforcement. It includes features like IP allocation, failover mechanisms, dual-stack support, and comprehensive observability via Prometheus metrics.