One policy in a control plane, compiled to BPF maps and pushed as signed bundles over mTLS — instead of iptables rules drifting across hundreds of hosts.
role in (web, api)env = prodallow tcp 443 → object-group: payment-gwHand-rolled iptables across a fleet is neither verifiable nor provable: rules drift, there is no dry-run, and only whoever edited a host knows what changed.
“iptables does not scale well. Period.” · “easy to cut yourself off from the remote machine” · “change iptables on 500 machines from one central browser”
Central control, distributed enforcement: the control plane holds the policy, per-host eBPF enforces it.
Rules are declared with label selectors in the control plane — once, with review, not by hand per host.
The CP finds affected hosts by cascade and compiles the policy to BPF maps. Dry-run before apply.
Each bundle is Ed25519-signed and pushed over mTLS gRPC. Agents apply only a valid signature.
The agent writes rules into the TC-hook datapath. No iptables chains, no conflicts.
A forgotten rule should not take down your production. The default passes traffic; the move to default-deny is staged and observable, not big-bang out of the box.
Every access change is recorded before and after. One console for the whole fleet instead of N scattered rule sets.
An autonomous control plane that needs no cluster. “Simpler than Cilium” where the fleet isn’t Kubernetes.
Installs from local artifacts, never phones home. Fit for closed networks.
Shows which hosts and rules will be added and removed, and what observed traffic it touches — before the policy ships. Against endless manual tweaking and blind blast radius.
A deterministic firewall: your rule fires, not a heuristic. Less noise than behavioural detection.
Every access change with before-and-after state. For compliance and incident review.
Verdict, system and audit events — in CEF/LEEF/ECS/RFC5424 over syslog/HTTP/Kafka transports. A verdict is your rule firing, without alert noise.
mTLS between agents and CP, certs issued by the control plane. Signed bundles = policy authenticity.
Terraform, PR review, signed bundles and an audit trail — closing Dev, Sec and Ops at once.
Terraform provider (not in the public Registry yet) · dry-run + cascade + auto-rollback · kernel-adaptive attach: TCX on ≥6.6 coexists with Cilium.
Honest about limits: up to 2048 rules on ≥5.17; on <6.6 alongside Cilium, attach is not possible.
The cloud version is a private beta: limited seats, no availability guarantees. Still in development — not a shipped product.
One policy in a control plane instead of hand-edited rules per host: label selectors, cascade to affected hosts, dry-run and before/after audit. Enforcement is on eBPF/TC, without iptables chains.
No. The control plane is autonomous, no k8s or etcd. Agents install on any Linux host (deb/rpm/Ansible).
Yes. Installs from local artifacts, updates via a registry mirror inside the perimeter, CA pinned by fingerprint. No outbound calls.
No. The default is fail-open, so a forgotten rule can’t cut a host off. The move to default-deny is managed and staged: observe first, then deny.
Demo and pilot run alongside your current rules (coexist), breaking nothing. Limited seats in the cloud beta.