Cilium networking at AI scale is the headline of CiliumCon 2026, where the agenda pivoted to address the pressures AI and GPU workloads place on Kubernetes networking and the accelerated pace of vulnerability discovery. Practitioners who manage platforms, run CI/CD pipelines, or secure clusters need to understand the new focus on IPv6‑only clusters, RDMA policy enforcement, sidecarless mTLS, and runtime protection with Tetragon because these topics directly affect design decisions, deployment workflows, and incident response.
AI‑driven networking challenges
The conference highlighted that AI and GPU workloads are exposing limits in the traditional Kubernetes CNI model. Sessions covered practical scenarios such as:
- Running clusters on IPv6 only, which eliminates NAT and simplifies address management for large AI fleets.
- Enforcing network policies on RDMA traffic, a requirement for low‑latency GPU communication.
- Debugging inference‑related traffic with eBPF, providing visibility into packet paths that standard tools miss.
These examples illustrate the kinds of problems teams will encounter as they scale AI workloads beyond the assumptions baked into earlier CNI designs.
Runtime security under accelerated vulnerability cycles
AI‑generated vulnerability discovery, exemplified by models like Mythos, is shortening the window between CVE publication and exploitation. CiliumCon responded with a security track that emphasized kernel‑level enforcement and rapid response mechanisms:
Tetragonoffers runtime security policies that can be applied without modifying application code.- Sidecarless mTLS provides pod‑to‑pod authentication directly in the kernel, removing the need for sidecar proxies.
- Discussion of how faster CVE surfacing forces teams to adopt automated detection rather than manual patch cycles.
Architectural and operational implications
From the sessions, several concrete considerations emerge for platform and SRE teams:
- IPv6‑only deployment: Validate that all services, DNS, and external dependencies support IPv6 before committing to an IPv6‑only topology.
- Large‑scale CNI datapath migration: Expect disruptions during netkit migrations; plan incremental rollouts and capture baseline metrics.
- RDMA policy enforcement: Map GPU‑attached workloads to specific policy groups and test policy impact in a staging environment.
- Packet‑loss tracing: Leverage eBPF programs to instrument latency‑sensitive paths, using Hubble for observability.
- Runtime security tooling: Deploy Tetragon alongside Cilium to enforce policies without sidecars, and integrate its alerts into existing SRE incident pipelines.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
Teams should treat the CiliumCon agenda as a checklist for upcoming AI‑centric workloads. Start by experimenting with IPv6‑only clusters in a sandbox, prototype RDMA policies on a subset of GPU nodes, and enable Tetragon to evaluate its runtime policy model. Align monitoring (Hubble) and security (Tetragon) upgrades with any planned CNI migrations to avoid overlapping changes. Finally, keep an eye on the evolving AI‑driven vulnerability landscape and consider automating policy updates to stay ahead of fast‑moving CVEs.
