You know that sinking feeling when your cluster networking and security layers start behaving like they live in different time zones? Cilium Compass was built to fix exactly that. It gives you visibility and policy control that feels unified instead of duct-taped together. If you’ve ever chased an ephemeral service IP across your observability tools, you’ll appreciate Compass immediately.
At its core, Cilium Compass extends the Cilium ecosystem into an application-centric navigation layer. Cilium’s eBPF power brings kernel-level security and metrics, while Compass stitches those insights into directional policy maps across clusters and workloads. You can see how identities flow, how API calls traverse service meshes, and how network policies translate to real running pods. It’s infrastructure observability built for humans, not auditors.
Here’s how it comes together. Compass taps into Cilium’s eBPF agent to collect network identity information, then correlates that data with orchestrator states from Kubernetes or cloud providers like AWS. It gives an at-a-glance map of traffic, permissions, and security posture. Instead of manually tracing IP hops or stale label selectors, you get a topological view—one that connects pods to actual business applications.
When you integrate Compass with your identity provider, like Okta or an OIDC-based system, the visibility goes beyond packets. You start seeing who triggered actions, how credentials move across workloads, and where compliance controls apply. That’s critical for regulated teams chasing SOC 2 or ISO 27001 audits, because Compass translates those controls into verifiable proofs of least privilege.
Best practices for setup are straightforward. Always enable service identity mapping early, so Compass can index workloads right from deployment. Rotate credentials automatically; Compass respects those updates and keeps your policy view consistent. Finally, feed Compass logs into your SIEM—structured events make threat detection a hundred times faster.