eBPF-based network policy vs CNI plugins — real-world tradeoffs?

Evaluating Cilium for a multi-tenant K8s cluster (200+ nodes). Current setup uses Calico with standard NetworkPolicy. The motivation: we need L7-aware policies for service mesh replacement and want to reduce iptables rule explosion. Specific concerns: - Performance overhead at scale (latency tail impact on p99) - Kernel version dependencies — we're mixed 5.15/6.1 across the fleet - Migration path from Calico: can we run both during transition or is it cutover-only? - Operator maturity: how many people actually run Cilium in prod with >100 nodes? Looking for operator experience, not vendor docs. Jurisdiction: AGNOSTIC