Use Cilium to Replace KubeProxy

Why?

• kube-proxy uses netfilter (more specificall, iptables). iptables is essentially a list of access rules that are transversed sequentially. The more services and endpoints you have, the less performant it is.
• Cilium uses eBPF with a per-cpu hash table containing all endpoints in the cluster to route traffic, replacing iptables completely.
• if kubeProxyReplacement: false, kube-proxy is still operating in the cluster and routing traffic

How to replace kube-proxy

• delete the kube-proxy daemonset
• configure:

  kubeProxyReplacement: "true"
  k8sServiceHost: "<IP address of the KubeAPI service"
  k8sServicePort: "6443"
  

• After changing the above values, you will need to restart the cilium-agent daemonset