What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An empty listing of kube-proxy iptables rules can be normal after a migration to Cilium: when kube-proxy replacement is enabled, Cilium can handle Kubernetes Service traffic through its eBPF datapath instead. The empty listing alone does not show whether that replacement is configured correctly or working. Start by checking Cilium’s configuration and health, then investigate the affected Service, its backends, node addressing, and any leftover resources from the previous network plugin.
Does Cilium replace kube-proxy?
Yes. Cilium can replace kube-proxy and provide Kubernetes Service handling through eBPF, so the absence of kube-proxy’s KUBE iptables chains may be expected. Confirm that kube-proxy replacement is intended and enabled, and that Cilium is healthy, before treating an empty listing as a fault. Cilium’s kube-proxy-free guide explains the replacement model; its troubleshooting guide recommends validating the kubeProxyReplacement setting.
As an Amazon Associate I earn from qualifying purchases.
An empty listing by itself cannot distinguish a healthy eBPF-based setup from an incomplete migration or a misconfigured replacement.
Recommended Free Tools
Check that the migration and Cilium rollout completed
Before inspecting individual traffic failures, establish whether the cluster finished the migration. Check Cilium’s status and whether its agents are ready. The Cilium migration guide describes applying the final configuration, restarting the Cilium DaemonSet, waiting for status, and then removing the previous network plugin. If the rollout or migration steps are incomplete, resolve that state before drawing conclusions from host firewall rules.
#1 Best Overall
Trace the affected Service from Kubernetes to Cilium
Choose one affected Service and follow its state in layers. First check whether Kubernetes has matching endpoints; then, if endpoints exist, inspect Cilium’s service and backend state. These checks separate a Service with no eligible backends from a problem in Cilium’s handling of an otherwise populated Service.
1. Check whether the Service has endpoints
Use the Kubernetes Debug Services guide to inspect the Service and its endpoints. If Kubernetes reports no endpoints, investigate why the Service has no matching backends before focusing on the datapath. If endpoints are present, continue to Cilium’s view of the Service and its backends.
2. Inspect Cilium’s Service and backend state
For a Service with endpoints, use Cilium’s troubleshooting guidance to inspect service and backend state. Compare that view with Kubernetes’ endpoint information. The mismatch, if any, helps narrow the fault to control-plane Service state or Cilium’s datapath rather than the mere absence of kube-proxy chains.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify node IP selection on multi-interface nodes
If nodes have more than one network interface, check that kubelet’s --node-ip is set to the intended address. Compare each node’s Kubernetes InternalIP with the expected device and address. Cilium’s kube-proxy-free documentation warns that incorrect node IP selection in multi-interface environments can interfere with kube-proxy replacement.
Separate old-plugin residue from current networking health
A migration can leave artifacts from the previous network plugin even when the current Cilium datapath is a separate question. Cilium’s migration guide notes that most network plugins leave resources such as iptables rules and interfaces, and that these are cleaned up on the node’s next reboot. Treat a reboot as a cleanup option to evaluate under your cluster’s maintenance and availability procedures—not as a substitute for checking Cilium’s status and the affected Service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the next diagnostic branch by traffic type
“Networking is broken” is too broad to guide the next check. Identify the failing path and the environment before applying a fix:
- Traffic type: Is the failure with ClusterIP, NodePort, LoadBalancer, pod-to-pod traffic, DNS, or API-server access?
- Cluster context: What Kubernetes and Cilium versions are in use, and what Cilium Helm values configure kube-proxy replacement?
- Migration state: How was migration performed, and was kube-proxy removed?
- Observed state: Are Cilium agents ready, does the Service have endpoints, and does Cilium report the expected service and backends?
These details determine which part of the configuration or datapath to investigate. Without them, an empty iptables listing does not support a distribution-specific diagnosis or a generic workaround.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
