The same reason that all new C projects aren’t being written in rust.

There is a lot of expertise floating around in the ~30ish years of netfilter so that is a ton of momentum in terms of the personal expertise of more experienced devs as well as the blogs/tutorials available when you search for “network filtering Linux”.

The default of kubernetes is still huge iptables chains and the only realistic ebpf alternative is mainly driven by a currently unsustainable startup (Cilium). The maturity just isn’t there yet.

I believe Cilium (ebpf based) is now default in kubernetes.

Can you elaborate more on the source of your belief?

Right!? That's the first thing I looked for in the project page. I'm really surprised it isn't using ebpf, but netfilter and a kernel module let them run back on 2.4 (but why?) I'm waiting for a bpf based solution to pop up as I think it will be superior in performance, ability, and maintainability.

BPF is so cool, yet so inaccessible so most tinkerers. If it had Python bindings I'd start using it today, but as is - it's esoteric.

Well clear your schedule, it's most commonly used interface is through it's python bindings (a library called BCC):

https://github.com/iovisor/bcc

if you have a huge size of iptables list yes bpf is important, bpf is more for performance reasons otherwise iptables suits the need just fine, in this case of personal firewall, iptables shall be good(and simple) enough