Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Replacing kube-proxy with an eBPF-based implementation changes two things at once: how Kubernetes Service traffic reaches Pods and which component emits the signals your dashboards expect. A Cilium replacement can preserve Service features, but it does not automatically preserve kube-proxy metrics, Prometheus targets, labels, alerts, or historical time series. If those dependencies are removed without a monitoring migration, a dashboard can appear healthy simply because its data source has disappeared.
The six-hour outage described in the headline is an operator-reported account, not an independently verified incident record. The reliable lesson is broader: treat kube-proxy removal as a datapath and observability migration, stage it per node, prove the replacement signals are being scraped, and keep a rollback path before changing production traffic.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What changes when you replace kube-proxy with eBPF?
kube-proxy normally runs on every node, watches Services and EndpointSlices, and programs the node to capture traffic sent to a Service virtual IP and port. It then redirects that traffic to an available endpoint. Kubernetes documents this model and permits another component to implement the Service abstraction instead: Kubernetes Virtual IPs and Service Proxies.
With Cilium’s kube-proxy-free mode, eBPF programs perform the Service translation and load balancing. The documented replacement covers ClusterIP, NodePort, LoadBalancer, externalIPs, and hostPort, but the exact behavior depends on the Cilium release, kernel, cloud platform, and other networking components.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
This is not a harmless DaemonSet deletion. Cilium warns that removing kube-proxy can break existing Service connections and stop Service traffic until replacement is installed. When both implementations are present, each maintains independent state; handing traffic from one to the other can also break existing connections. Plan for connection disruption rather than describing the change as a seamless toggle (Cilium: Kubernetes Without kube-proxy).
Why can monitoring go blind after kube-proxy is removed?
The most likely explanation is a broken observability dependency, not that eBPF has no telemetry. Kubernetes control-plane components, including kube-proxy, expose Prometheus-format metrics. A monitoring stack may discover those endpoints through a Service, label selector, or static target and build dashboards and alerts around metric names that exist only while kube-proxy is running. Remove the process and the series stop arriving; panels can go blank while the rest of the cluster remains active. Kubernetes describes the component-metrics pipeline in its Observability documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Cilium exposes different streams. Its agent, Envoy, and operator metrics describe process and component health. Hubble metrics describe network behavior generated by Cilium-managed workloads. Those streams are complementary, not drop-in replacements for kube-proxy series. A query for a kube-proxy metric will not automatically find an equivalently named Cilium series, and a dashboard that relies on kube-proxy labels may lose node, namespace, or service dimensions.
Documentation therefore supports a failure hypothesis: a dashboard or alert can go silent when its kube-proxy source disappears. It does not prove that this caused the particular six-hour incident in the title. To establish a root cause, compare the time of the migration with Prometheus target health, scrape errors, query results, alert evaluations, and the actual Service symptoms.
Which signals should replace kube-proxy metrics?
Build observability around the question each signal answers, rather than searching for one universal replacement metric.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Agent and component health
Scrape Cilium agent and operator metrics to learn whether the replacement processes are running, ready, and able to reconcile cluster state. If Envoy is part of your deployment, collect its metrics separately. These are component-health signals; they do not show every packet or Service request.
Network behavior and flow visibility
Enable Hubble metrics for traffic involving Cilium-managed Pods. Depending on the metrics and context labels selected, Hubble can expose traffic rates, drops, policy verdicts, DNS activity, and other flow dimensions. Hubble is useful for detecting behavior changes that a process-health metric cannot reveal.
Datapath events and health checks
For socket load-balancing datapath events, Cilium points operators to Hubble and cilium monitor. These event streams help answer “what happened to this packet?” during an investigation. Cilium also offers an optional kube-proxy-replacement /healthz server; it is disabled unless you configure a bind address. A health endpoint is not a substitute for flow telemetry or time-series alerting.
Service and endpoint state
Continue watching Kubernetes Services and EndpointSlices. A healthy Cilium agent cannot make an empty EndpointSlice serve traffic, and a correct endpoint set does not prove that every node can reach the Service IP. Keep control-plane object health, datapath behavior, and scrape health as separate panels and alert groups.
How do I migrate kube-proxy replacement safely?
Use a staged, per-node rollout and verify the effective configuration after every change. Cilium’s documented procedure assumes you first make the API server reachable without kube-proxy, then migrate selected nodes, and only afterward remove the old DaemonSet. Adapt the sequence to the exact Cilium release and cluster topology described in the per-node configuration guide.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
1. Record the current state
- Save the Kubernetes and Cilium versions, node operating-system and kernel versions, CNI settings, Service CIDR, and proxy mode.
- Export the current kube-proxy DaemonSet, its configuration, and the labels or selectors used by Prometheus discovery.
- List critical Services, their EndpointSlices, and long-lived connections such as databases, queues, and ingress paths.
- Capture baseline dashboards and alert results so you can distinguish a real traffic change from a missing time series.
2. Make API-server reachability explicit
Set Cilium’s k8sServiceHost and k8sServicePort for the control-plane endpoint that remains reachable when kube-proxy is absent. Cilium identifies these values as prerequisites; without them, an agent may lose API access after you uninstall the proxy. Use the endpoint appropriate to your platform, not a copied address from another cluster.
3. Prepare observability before traffic changes
Enable Cilium Prometheus metrics and Hubble metrics in the Helm configuration for your release. If you use the Prometheus Operator, enable the corresponding ServiceMonitor integration and confirm that its namespace and label selectors match your Prometheus instance. Verify the endpoints from inside the cluster, check that Prometheus reports them as UP, and create panels and alerts before migrating a node. Retain old kube-proxy panels temporarily so an intentional series disappearance is visible.
4. Select a canary node
Label or otherwise target one non-critical node for replacement. Keep kube-proxy scheduled on nodes that have not been selected. Apply the per-node replacement setting, then inspect the effective value on the node rather than trusting the intended Helm file. Drain or quiesce workloads that cannot tolerate a brief connection interruption, and announce the change to application owners.
5. Test the full Service path
- Check the Cilium agent status on the canary node and confirm it can reach the API server.
- Resolve a test Service by DNS and connect through its ClusterIP from a Pod on the canary.
- Test NodePort, LoadBalancer, externalIP, and hostPort paths that your applications actually use.
- Observe Hubble flows and, when needed, run
cilium monitorto inspect datapath events. - Verify Prometheus scrape status, Cilium and Hubble series, dashboard labels, and alert evaluations.
- Repeat tests from a node that still runs kube-proxy to catch topology-specific failures.
6. Expand gradually and clean up last
Migrate additional nodes in small batches, watching connection errors, dropped flows, EndpointSlice updates, API-server errors, and scrape failures between batches. Only after every node is on the replacement and rollback data is preserved should you remove the kube-proxy DaemonSet. Keep the exported manifest and the reverse per-node configuration until application owners confirm that long-lived connections and scheduled jobs are stable.
How do I enable Hubble metrics for Prometheus?
Hubble metrics and Cilium agent metrics are independently configurable. The exact Helm keys and available metric names vary by Cilium release, so use the version-matched Cilium Monitoring and Metrics documentation rather than copying a chart from another version.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Enable the Cilium Prometheus endpoint and, if applicable, the operator and Envoy endpoints.
- Enable Hubble metrics and select only the flow dimensions you can retain and operate. Context labels increase cardinality and storage cost.
- Expose the endpoints through the ServiceMonitor or scrape configuration used by your Prometheus deployment.
- Check target discovery in Prometheus, then query a short time range for fresh samples. A configured endpoint that is not discovered is operationally equivalent to a disabled endpoint.
- Create alerts for agent readiness, scrape failures, absent Hubble samples, and meaningful traffic or drop conditions. An “absent” alert should distinguish a quiet workload from a dead exporter by pairing it with target and workload activity checks.
Keep retention and permissions in the design. Flow metrics can be much higher cardinality than a small set of component gauges, and a dashboard may need recording rules to remain responsive. Decide who owns the scrape configuration, dashboards, and alert routing before the migration window.
What should I check when Services fail during or after migration?
Separate object state, node datapath, application health, and monitoring. Kubernetes’ Service debugging guide provides the general sequence; where it refers to kube-proxy, substitute Cilium agent and datapath checks.
If a Service has no usable endpoints
- Inspect the Service selector and the labels on candidate Pods.
- Read the EndpointSlices and confirm addresses, readiness conditions, ports, and address families.
- Check that the Pods are ready and that NetworkPolicy is not denying the intended path.
If endpoints are healthy but the ClusterIP fails
- Test from Pods on multiple nodes and record whether failure follows a node.
- Check Cilium agent status and recent events on an affected node.
- Use Hubble flows and
cilium monitorto distinguish a policy drop, a translation problem, a return-path failure, or a refused application connection. - Verify that the Service port, targetPort, protocol, and address family match the listening process.
If traffic works but dashboards are empty
- Inspect Prometheus target health and scrape error messages.
- Run the old kube-proxy query and a new Cilium or Hubble query over the same time range; do not assume equal label names.
- Check relabeling, namespace selectors, ServiceMonitor selectors, and permissions.
- Look for an alert rule that treats “no series” as “zero,” which can hide an exporter outage.
If an application has broken long-lived connections
Expect this possibility during delegation between independent datapaths. Reconnect clients or restart only the affected workloads after confirming that new connections succeed, and preserve connection-error timestamps for the postmortem. If new Service traffic is also failing, stop the rollout and restore the last known-good per-node setting rather than deleting more networking components.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What are the trade-offs between kube-proxy and eBPF replacement?
| Decision area | Retaining kube-proxy | Using Cilium replacement |
|---|---|---|
| Service datapath | Uses the Kubernetes proxy mechanisms supported by the selected mode and release. | Uses Cilium eBPF for documented ClusterIP, NodePort, LoadBalancer, externalIP, and hostPort functions; verify release and platform compatibility. |
| Migration risk | No proxy handoff is required, so this specific connection-disruption event is avoided. | Requires staged node changes; existing connections can break while delegation or state synchronization changes. |
| Observability | Kube-proxy component metrics remain available to existing scrapes. | Cilium agent, Hubble, and optional health signals must be enabled, discovered, retained, queried, and alerted on deliberately. |
| Operational fit | Often simpler for integrations that assume kube-proxy behavior. | Can unify Service handling and network visibility, but requires suitable kernel capabilities, Cilium configuration, and ownership of higher-cardinality telemetry. |
| Performance evidence | No cluster-specific benchmark is established here. | No performance improvement should be assumed without testing your own workloads and failure modes. |
Which integrations and Kubernetes versions need extra care?
Check service-mesh assumptions before enabling full replacement. Cilium’s Istio integration documentation describes a mode that retains kube-proxy for minimal disruption in covered configurations and a full-replacement mode using kubeProxyReplacement: true, socketLB.hostNamespaceOnly: true, and cni.exclusive: false. Those values are not universal defaults; confirm the applicable Istio and Cilium releases, sidecar behavior, and ownership of the CNI before applying them (Cilium and Istio integration).
Also identify the proxy mode you are replacing. Kubernetes currently marks IPVS mode as deprecated from v1.35, plans to disable it by default from v1.40, and plans full removal in v1.43. These are project plans tied to release timelines, so verify the guidance for the Kubernetes version you will run instead of treating the dates as a timeless guarantee (Kubernetes Virtual IPs and Service Proxies).
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
How do I recover if the migration causes an outage?
First protect application availability: stop further node changes, identify whether failures are limited to one node or one Service class, and restore the last known-good per-node setting if your rollback has been tested. Do not remove Cilium or flush node networking as a first reaction; that can destroy the evidence and widen the outage.
Record the exact times of the configuration change, first failed connection, first missing scrape, and first alert. Compare Service and EndpointSlice objects with Cilium events and Prometheus target history. Once traffic is stable, restore or rerun the observability migration in a staging cluster, add an explicit absent-series alert, and repeat the canary with a documented rollback threshold. A successful rollback without a telemetry explanation is recovery, not a completed postmortem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What is the practical lesson from a six-hour monitoring gap?
Replacing kube-proxy is a coordinated datapath change, not merely a CNI feature switch. The safest design keeps three independent views: Kubernetes object state, Cilium datapath and flow behavior, and Prometheus collection health. When all three are tested on a canary node before broad rollout, the disappearance of kube-proxy metrics becomes an intentional, visible migration event instead of a silent blind spot.
Frequently Asked Questions
Can I keep kube-proxy and Cilium eBPF enabled at the same time?
A temporary coexistence period is possible in some migration designs, but the two datapaths maintain independent state. Cilium documents that switching delegation can still break existing connections, so coexistence should be a tightly controlled transition rather than a permanent assumption.
Do Hubble metrics replace Kubernetes Service metrics?
No. Hubble describes network flows and behavior, while Kubernetes and kube-proxy metrics describe component or control-plane conditions. Use both object-level and datapath-level signals when diagnosing a Service.
How can I tell a quiet workload from a dead Hubble exporter?
Pair flow-series checks with Prometheus target health, Cilium agent readiness, and an independent workload-activity signal such as request counters or synthetic probes. Alerting only on absent flow samples will create false positives for legitimately idle namespaces.
What information should a migration postmortem include?
Document Kubernetes and Cilium versions, node and kernel topology, exact per-node settings, Service classes affected, Prometheus target history, missing metric names, Hubble configuration, connection-error timestamps, and the tested rollback sequence. This evidence distinguishes a datapath defect from a monitoring-discovery failure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
