Use Cilium to Replace KubeProxy

Why?

• kube-proxy uses netfilter (more specificall, iptables). iptables is essentially a list of access rules that are transversed sequentially. The more services and endpoints you have, the less performant it is.
• Cilium uses eBPF with a per-cpu hash table containing all endpoints in the cluster to route traffic, replacing iptables completely.
• if kubeProxyReplacement: false, kube-proxy is still operating in the cluster and routing traffic

How to replace kube-proxy

• delete the kube-proxy daemonset
• configure:

  kubeProxyReplacement: "true"
  k8sServiceHost: "<IP address of the KubeAPI service"
  k8sServicePort: "6443"
  

• After changing the above values, you will need to restart the cilium-agent daemonset

Sticky Sessions

• Cilium supports sticky sessions, so that traffic directed to a pod will have all subsequent requests in the connection sent to that same pod.

Traffic Policies

• Cilium with kubeProxyReplacement enabled supports both the internalTrafficPolicy and externalTrafficPolicy traffic policies
• When you set internalTrafficPolicy to local Cilium forwards internal traffic to endpoints that are on that same node.
• externalTrafficPolicy is set to cluster by default. In this mode, any node that receives traffic can forward it to any ready backend in the cluster. This maximizes availability but comes with two caveats:
  1. source IP is not preserved
  2. an additional hop may be added as traffic won’t necessarily enter the node closest to the backend