Cilium or Calico: which fits us?

The decision is made when the cluster is built, because a later switch is a migration. A comparison with a decision rule is in the Cilium vs. Calico guide.

Are Kubernetes network policies enough?

Network policies are a Kubernetes resource that the CNI has to enforce. Without a CNI that supports them they have no effect (network policies). Cilium brings its own policy language.

Hubble is the network observability of Cilium and makes communication between services visible (Hubble).

Does WZ-IT also advise on service mesh?

Service mesh is not part of this service. The classification of Istio, Linkerd and Cilium is in the guide. The first steps without a mesh, Gateway API at the edge and default deny with network policies, belong to network and secure access.

CNI and policies are implemented as a project under network and secure access; scope and fee are agreed after an initial assessment. The check in the cluster audit costs from €1,490 excl. VAT one-time, individual questions in support €120 excl. VAT per hour.

Cilium as the CNI: network policies and Hubble in the cluster

In short: CNI selection, network policies with default deny and network observability for Kubernetes, with Cilium or another suitable CNI.

Cilium or a suitable CNI
Default deny and namespace boundaries
Required flows allowed
Network observability with Hubble

Request Cilium View scope

Reviews

IT Beratung Service Consulting Soforthilfe

Companies worldwide trust WZ-IT

Read client reviews

Starting point

When the cluster network needs attention

Typical situations in which CNI and policies are caught up.

The CNI choice is pending
The CNI is chosen when the cluster is built, and a later switch is a migration.
Everything may talk to everything
Without network policies, namespaces are not separated. Policies only work if the CNI enforces them (network policies).
The CNI runs, the policies are missing
The installation is done, but nobody has defined default deny and the required flows.
Flows are not visible
Anyone who wants to allow or block a connection needs to know which flows exist.

Services

What the Cilium service covers

CNI and network policies in the cluster. The broader network design with ingress, DNS and private access is under network and secure access.

CNI and policies

Choose or switch the CNI
Cilium or another suitable CNI. The Cilium vs. Calico guide classifies the choice.
Network policies
Namespace boundaries, default deny and the required flows.

Visibility and operations

Network observability
Make flows visible, with Hubble for Cilium.
CNI in operations
In operations the CNI is one of the add-ons: upgrades run as a planned change with a compatibility check against the Kubernetes version.

Service mesh is not part of the scope of this page. The classification of Istio, Linkerd and Cilium is in the guide. Ingress, Gateway API, DNS and private access are part of network and secure access.

Process

Four steps to clear network rules

From the current state to a documented policy.

01
Record the current state
CNI and version, existing policies, namespaces and communication relationships.
02
Define the target
CNI, namespace boundaries and default deny.
03
Introduce policies
Required flows are allowed, everything else stays blocked.
04
Hand over
Documentation of the rules and the path for CNI upgrades.

Assessment

In-house or supported CNI work

A cluster with a familiar CNI and maintained policies needs no support.

In-house

In-house operation is enough when

a cluster runs with a CNI the team knows
default deny and approved flows are implemented and documented
CNI upgrades are checked against the Kubernetes version

Support

Support makes sense when

a CNI switch is pending
policies are missing or were never checked against real flows
visibility into the network is missing

Entry point

Networking as a project, checks in the cluster audit

CNI and network policies are implemented under network and secure access. Whether the policies take effect in the cluster is checked by the cluster audit: network policies, namespace separation and externally reachable services.

Cluster auditfrom €1,490 excl. VAT one-timeConfiguration review with report, not a penetration test

View cluster audit Request Cilium

All prices are net and exclude statutory VAT. The offers are addressed to businesses. As of October 2026.

Alternatively

Project

Network and secure access

CNI, network policies and network observability as a project, scope and fee after an initial assessment.

View networking →Individual questions

Kubernetes Support

Questions on CNI selection or a switch without a contract, €120 excl. VAT per hour.

View support →

Frequently asked questions

Answers to the most important questions

Knowledge

Guides and sources on Cilium

CNI comparison, mesh classification and documentation.

Guides

Primary sources

Related services

Reviews & projects

Operations that visibly relieve customers

Customer feedback on monitoring, updates, maintenance, support and stable production systems.

Networking & Provisioning

WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.

Steve KirchnerManaging Director, nextGYM GmbH

View project

International

Built in Germany's Ruhr Valley. Running worldwide.

WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.