[{"data":1,"prerenderedAt":805},["ShallowReactive",2],{"blog-en-k3s-cilium-kube-proxy-replacement-nodeport-unreachable":3,"blog-related-en-k3s-cilium-kube-proxy-replacement-nodeport-unreachable":754,"blog-en-k3s-cilium-kube-proxy-replacement-nodeport-unreachable-alt":397},{"id":4,"title":5,"author":6,"body":7,"date":738,"description":739,"extension":740,"image":741,"locale":742,"meta":743,"navigation":397,"path":744,"seo":745,"stem":746,"tags":747,"__hash__":753},"blog\u002Fblog\u002Fen\u002Fk3s-cilium-kube-proxy-replacement-nodeport-unreachable.md","We Swapped kube-proxy for Cilium on K3s, and NodePort Stopped Working","Kubo Team",{"type":8,"value":9,"toc":722},"minimark",[10,14,21,26,29,52,55,61,64,68,77,128,135,189,202,205,210,230,234,237,243,247,264,271,275,278,282,347,358,362,488,501,505,564,575,581,590,594,614,629,636,640,643,697,704,708,711,718],[11,12,13],"p",{},"Have you ever followed the official documentation step by step to switch K3s networking to Cilium's eBPF-based kube-proxy replacement, only to find that NodePort traffic mysteriously stops getting through? ClusterIP communication works fine, but hitting a NodePort from outside the cluster returns nothing. This article walks through exactly where K3s's defaults diverge from Cilium's generic instructions, based on the specific points where things actually broke.",[11,15,16],{},[17,18],"img",{"alt":19,"src":20},"section01","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-cilium-kube-proxy-replacement-nodeport-unreachable\u002Fsection01.webp",[22,23,25],"h2",{"id":24},"_1-why-try-ciliums-kube-proxy-replacement-on-k3s","1. Why Try Cilium's kube-proxy Replacement on K3s",[11,27,28],{},"K3s ships with Flannel (CNI), a built-in kube-proxy, and ServiceLB (formerly Klipper LoadBalancer) out of the box. That's exactly what makes K3s attractive — it just works with zero extra configuration. But once a team needs deeper observability, network policy, or performance at production scale, Cilium — a CNCF Graduated project — becomes a natural next step.",[11,30,31,32,39,40,45,46,51],{},"Cilium runs inside the kernel via eBPF and performs service load balancing using hash tables instead of the linear rule processing that iptables relies on. This is said to achieve near-O(1) lookup time regardless of how many Services or endpoints exist (",[33,34,38],"a",{"href":35,"rel":36},"https:\u002F\u002Fthenewstack.io\u002Fbreaking-the-chains-of-kube-proxy-with-cilium\u002F",[37],"nofollow","The New Stack","). Cilium is considered one of the most active projects in the CNCF, behind only Kubernetes and OpenTelemetry, and it achieved CNCF Graduated status in October 2023 (",[33,41,44],{"href":42,"rel":43},"https:\u002F\u002Fisovalent.com\u002Fblog\u002Fpost\u002Fcilium-graduates-cncf",[37],"Isovalent's official blog",", ",[33,47,50],{"href":48,"rel":49},"https:\u002F\u002Fcloudnativenow.com\u002Ffeatures\u002Fcncf-graduates-cilium-networking-software-project\u002F",[37],"reported by CloudNativeNow",").",[11,53,54],{},"Given this, replacing Flannel and the built-in kube-proxy with Cilium's kube-proxy replacement has become a realistic option for K3s users. The problem is that Cilium's official instructions are written for a generic Kubernetes cluster (typically kubeadm-based), and if you leave K3s's own defaults untouched, you end up with a configuration that's \"half-duplicated\" in a way that causes trouble.",[11,56,57],{},[17,58],{"alt":59,"src":60},"section02","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-cilium-kube-proxy-replacement-nodeport-unreachable\u002Fsection02.webp",[11,62,63],{},"The time it takes to verify a CNI integration like this is never trivial. The fact that a managed option exists to offload that verification cost is worth keeping in mind when evaluating this kind of networking change.",[22,65,67],{"id":66},"_2-followed-the-official-steps-and-only-nodeport-broke","2. Followed the Official Steps, and Only NodePort Broke",[11,69,70,71,76],{},"Cilium's official K3s installation guide instructs you to bring up the master node like this (",[33,72,75],{"href":73,"rel":74},"https:\u002F\u002Fdocs.cilium.io\u002Fen\u002Fstable\u002Finstallation\u002Fk3s\u002F",[37],"Cilium official documentation","):",[78,79,84],"pre",{"className":80,"code":81,"language":82,"meta":83,"style":83},"language-bash shiki shiki-themes tokyo-night","curl -sfL https:\u002F\u002Fget.k3s.io | INSTALL_K3S_EXEC='--flannel-backend=none --disable-network-policy' sh -\n","bash","",[85,86,87],"code",{"__ignoreMap":83},[88,89,92,96,100,104,108,111,114,117,120,122,125],"span",{"class":90,"line":91},"line",1,[88,93,95],{"class":94},"sE3pS","curl",[88,97,99],{"class":98},"sT800"," -sfL",[88,101,103],{"class":102},"sPY7s"," https:\u002F\u002Fget.k3s.io",[88,105,107],{"class":106},"sAklC"," |",[88,109,110],{"class":94}," INSTALL_K3S_EXEC",[88,112,113],{"class":106},"=",[88,115,116],{"class":106},"'",[88,118,119],{"class":102},"--flannel-backend=none --disable-network-policy",[88,121,116],{"class":106},[88,123,124],{"class":94}," sh",[88,126,127],{"class":102}," -\n",[11,129,130,131,134],{},"To replace kube-proxy itself, you add the ",[85,132,133],{},"--disable-kube-proxy"," flag. The official docs also document a config-file approach:",[78,136,140],{"className":137,"code":138,"language":139,"meta":83,"style":83},"language-yaml shiki shiki-themes tokyo-night","# \u002Fetc\u002Francher\u002Fk3s\u002Fconfig.yaml\nflannel-backend: \"none\"\ndisable-network-policy: true\ndisable-kube-proxy: true\n","yaml",[85,141,142,148,167,179],{"__ignoreMap":83},[88,143,144],{"class":90,"line":91},[88,145,147],{"class":146},"sbD-w","# \u002Fetc\u002Francher\u002Fk3s\u002Fconfig.yaml\n",[88,149,151,155,158,161,164],{"class":90,"line":150},2,[88,152,154],{"class":153},"s0U2E","flannel-backend",[88,156,157],{"class":106},":",[88,159,160],{"class":106}," \"",[88,162,163],{"class":102},"none",[88,165,166],{"class":106},"\"\n",[88,168,170,173,175],{"class":90,"line":169},3,[88,171,172],{"class":153},"disable-network-policy",[88,174,157],{"class":106},[88,176,178],{"class":177},"sOJ5S"," true\n",[88,180,182,185,187],{"class":90,"line":181},4,[88,183,184],{"class":153},"disable-kube-proxy",[88,186,157],{"class":106},[88,188,178],{"class":177},[11,190,191,192,196,197,51],{},"This much is standard and shows up in plenty of guides. But after installing Cilium via Helm on top of this configuration, ClusterIP traffic works fine while ",[193,194,195],"strong",{},"NodePort access alone fails",". Even in Cilium's own issue tracker, there are documented patterns where NodePort stops functioning depending on how an IP address is attached to a network interface (",[33,198,201],{"href":199,"rel":200},"https:\u002F\u002Fgithub.com\u002Fcilium\u002Fcilium\u002Fissues\u002F12317",[37],"cilium\u002Fcilium Issue #12317",[11,203,204],{},"In K3s environments specifically, this symptom tends to stem from three compounding factors.",[206,207,209],"h3",{"id":208},"factor-1-servicelb-formerly-klipper-is-still-running","Factor 1: ServiceLB (formerly Klipper) Is Still Running",[11,211,212,213,218,219,222,223,225,226,229],{},"K3s ships ServiceLB by default, a lightweight load balancer that deploys a DaemonSet using hostPorts for every LoadBalancer-type Service (",[33,214,217],{"href":215,"rel":216},"https:\u002F\u002Fdocumentation.suse.com\u002Fcloudnative\u002Fk3s\u002Flatest\u002Fen\u002Fnetworking\u002Fnetworking-services.html",[37],"SUSE's official K3s networking documentation","). Setting ",[85,220,221],{},"--flannel-backend=none"," or ",[85,224,133],{}," does ",[193,227,228],{},"not"," automatically disable ServiceLB. With ServiceLB still active, its hostPort bindings can conflict with Cilium's eBPF load balancing on the same node, preventing traffic from reaching the expected NodePort.",[206,231,233],{"id":232},"factor-2-traefiks-default-setup-depends-on-servicelb","Factor 2: Traefik's Default Setup Depends on ServiceLB",[11,235,236],{},"K3s deploys the Traefik ingress controller by default, which exposes a LoadBalancer Service on ports 80 and 443. That LoadBalancer Service's path also depends on ServiceLB by default, so leaving Traefik enabled without resolving Factor 1 first destabilizes Ingress traffic as well.",[11,238,239],{},[17,240],{"alt":241,"src":242},"section03","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-cilium-kube-proxy-replacement-nodeport-unreachable\u002Fsection03.webp",[206,244,246],{"id":245},"factor-3-missing-api-server-connection-info-k8sservicehostk8sserviceport","Factor 3: Missing API Server Connection Info (k8sServiceHost\u002Fk8sServicePort)",[11,248,249,250,253,254,257,258,263],{},"Once kube-proxy is removed, the cluster also loses the \"proxy the API server Service\" function that kube-proxy used to provide. Cilium's official documentation explains that ",[85,251,252],{},"k8sServiceHost"," and ",[85,255,256],{},"k8sServicePort"," must be explicitly specified so the Cilium agent can still reach the API server (",[33,259,262],{"href":260,"rel":261},"https:\u002F\u002Fdocs.cilium.io\u002Fen\u002Flatest\u002Fnetwork\u002Fkubernetes\u002Fkubeproxy-free\u002F",[37],"Cilium official: Kubernetes Without kube-proxy","). K3s quickstart instructions often omit this setting, leaving the Cilium agent's initialization incomplete and destabilizing Service connectivity across the board.",[11,265,266,267,270],{},"The same documentation further notes that because kube-proxy's and Cilium's NAT tables are unaware of each other, ",[193,268,269],{},"connections can break if the two run simultaneously even briefly",". In a distribution like K3s, which bundles multiple networking components by default, this kind of \"temporary coexistence\" happens easily.",[22,272,274],{"id":273},"_3-the-k3s-specific-configuration-differences","3. The K3s-Specific Configuration Differences",[11,276,277],{},"With these three factors in mind, here's how to configure Cilium's kube-proxy replacement to run stably on K3s.",[206,279,281],{"id":280},"master-node-startup-options","Master Node Startup Options",[78,283,285],{"className":80,"code":284,"language":82,"meta":83,"style":83},"curl -sfL https:\u002F\u002Fget.k3s.io | INSTALL_K3S_EXEC=\"\\\n  --flannel-backend=none \\\n  --disable-network-policy \\\n  --disable-kube-proxy \\\n  --disable=servicelb \\\n  --disable=traefik\" sh -\n",[85,286,287,304,312,319,326,334],{"__ignoreMap":83},[88,288,289,291,293,295,297,299,301],{"class":90,"line":91},[88,290,95],{"class":94},[88,292,99],{"class":98},[88,294,103],{"class":102},[88,296,107],{"class":106},[88,298,110],{"class":94},[88,300,113],{"class":106},[88,302,303],{"class":106},"\"\\\n",[88,305,306,309],{"class":90,"line":150},[88,307,308],{"class":102},"  --flannel-backend=none ",[88,310,311],{"class":106},"\\\n",[88,313,314,317],{"class":90,"line":169},[88,315,316],{"class":102},"  --disable-network-policy ",[88,318,311],{"class":106},[88,320,321,324],{"class":90,"line":181},[88,322,323],{"class":102},"  --disable-kube-proxy ",[88,325,311],{"class":106},[88,327,329,332],{"class":90,"line":328},5,[88,330,331],{"class":102},"  --disable=servicelb ",[88,333,311],{"class":106},[88,335,337,340,343,345],{"class":90,"line":336},6,[88,338,339],{"class":102},"  --disable=traefik",[88,341,342],{"class":106},"\"",[88,344,124],{"class":94},[88,346,127],{"class":102},[11,348,349,350,353,354,357],{},"The key addition beyond Cilium's official steps is explicitly adding ",[85,351,352],{},"--disable=servicelb",". If you plan to keep using Traefik, drop ",[85,355,356],{},"--disable=traefik"," and re-enable it only after confirming NodePort works as described below — this makes troubleshooting far easier.",[206,359,361],{"id":360},"required-cilium-helm-parameters","Required Cilium Helm Parameters",[78,363,365],{"className":80,"code":364,"language":82,"meta":83,"style":83},"helm repo add cilium https:\u002F\u002Fhelm.cilium.io\u002F\nhelm repo update\n\nhelm install cilium cilium\u002Fcilium \\\n  --namespace kube-system \\\n  --set kubeProxyReplacement=true \\\n  --set k8sServiceHost=\u003CAPI_SERVER_IP> \\\n  --set k8sServicePort=6443 \\\n  --set ipam.operator.clusterPoolIPv4PodCIDRList=\"10.42.0.0\u002F16\"\n",[85,366,367,384,393,399,414,424,437,460,473],{"__ignoreMap":83},[88,368,369,372,375,378,381],{"class":90,"line":91},[88,370,371],{"class":94},"helm",[88,373,374],{"class":102}," repo",[88,376,377],{"class":102}," add",[88,379,380],{"class":102}," cilium",[88,382,383],{"class":102}," https:\u002F\u002Fhelm.cilium.io\u002F\n",[88,385,386,388,390],{"class":90,"line":150},[88,387,371],{"class":94},[88,389,374],{"class":102},[88,391,392],{"class":102}," update\n",[88,394,395],{"class":90,"line":169},[88,396,398],{"emptyLinePlaceholder":397},true,"\n",[88,400,401,403,406,408,411],{"class":90,"line":181},[88,402,371],{"class":94},[88,404,405],{"class":102}," install",[88,407,380],{"class":102},[88,409,410],{"class":102}," cilium\u002Fcilium",[88,412,413],{"class":106}," \\\n",[88,415,416,419,422],{"class":90,"line":328},[88,417,418],{"class":98},"  --namespace",[88,420,421],{"class":102}," kube-system",[88,423,413],{"class":106},[88,425,426,429,432,435],{"class":90,"line":336},[88,427,428],{"class":98},"  --set",[88,430,431],{"class":102}," kubeProxyReplacement=",[88,433,434],{"class":177},"true",[88,436,413],{"class":106},[88,438,440,442,445,448,451,455,458],{"class":90,"line":439},7,[88,441,428],{"class":98},[88,443,444],{"class":102}," k8sServiceHost=",[88,446,447],{"class":106},"\u003C",[88,449,450],{"class":102},"API_SERVER_I",[88,452,454],{"class":453},"sGX4V","P",[88,456,457],{"class":106},">",[88,459,413],{"class":106},[88,461,463,465,468,471],{"class":90,"line":462},8,[88,464,428],{"class":98},[88,466,467],{"class":102}," k8sServicePort=",[88,469,470],{"class":177},"6443",[88,472,413],{"class":106},[88,474,476,478,481,483,486],{"class":90,"line":475},9,[88,477,428],{"class":98},[88,479,480],{"class":102}," ipam.operator.clusterPoolIPv4PodCIDRList=",[88,482,342],{"class":106},[88,484,485],{"class":102},"10.42.0.0\u002F16",[88,487,166],{"class":106},[11,489,490,493,494,496,497,51],{},[85,491,492],{},"\u003CAPI_SERVER_IP>"," should be an API server address reachable from every worker node (the master node's IP, or a load balancer VIP in an HA setup). Don't forget to match K3s's default Pod CIDR (",[85,495,485],{},") — a value explicitly documented in Cilium's own K3s installation guide (",[33,498,500],{"href":73,"rel":499},[37],"Cilium official documentation: Installation Using K3s",[206,502,504],{"id":503},"verifying-nodeport-connectivity","Verifying NodePort Connectivity",[78,506,508],{"className":80,"code":507,"language":82,"meta":83,"style":83},"# Check whether Cilium's service list has registered the NodePort\ncilium service list\n\n# Actually hit the NodePort to confirm\ncurl http:\u002F\u002F\u003CNODE_IP>:\u003CNODE_PORT>\n",[85,509,510,515,526,530,535],{"__ignoreMap":83},[88,511,512],{"class":90,"line":91},[88,513,514],{"class":146},"# Check whether Cilium's service list has registered the NodePort\n",[88,516,517,520,523],{"class":90,"line":150},[88,518,519],{"class":94},"cilium",[88,521,522],{"class":102}," service",[88,524,525],{"class":102}," list\n",[88,527,528],{"class":90,"line":169},[88,529,398],{"emptyLinePlaceholder":397},[88,531,532],{"class":90,"line":181},[88,533,534],{"class":146},"# Actually hit the NodePort to confirm\n",[88,536,537,539,542,544,547,549,551,553,555,558,561],{"class":90,"line":328},[88,538,95],{"class":94},[88,540,541],{"class":102}," http:\u002F\u002F",[88,543,447],{"class":106},[88,545,546],{"class":102},"NODE_I",[88,548,454],{"class":453},[88,550,457],{"class":106},[88,552,157],{"class":102},[88,554,447],{"class":106},[88,556,557],{"class":102},"NODE_POR",[88,559,560],{"class":453},"T",[88,562,563],{"class":106},">\n",[11,565,566,567,570,571,574],{},"If ",[85,568,569],{},"cilium service list"," doesn't show a NodePort entry, ServiceLB's hostPort bindings are likely still conflicting. Run ",[85,572,573],{},"kubectl get pods -n kube-system -l app=svclb"," to check whether any ServiceLB pods remain.",[11,576,577],{},[17,578],{"alt":579,"src":580},"section04","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-cilium-kube-proxy-replacement-nodeport-unreachable\u002Fsection04.webp",[11,582,583,584,589],{},"Once Cilium's Service implementation is stable this way, the same standardized approach to networking can be reproduced in a managed environment built on Pure Kubernetes, such as Kubo Cloud. ",[33,585,588],{"href":586,"rel":587},"https:\u002F\u002Fkubo.hexabase.io\u002F",[37],"Kubo"," is K3s-based while maintaining full standard Kubernetes API compatibility, so CNCF Graduated projects like Cilium can be adopted directly, without lock-in.",[22,591,593],{"id":592},"_4-externaltrafficpolicy-and-traefik-what-to-watch-for","4. externalTrafficPolicy and Traefik: What to Watch For",[11,595,596,597,600,601,604,605,608,609,51],{},"After disabling ServiceLB and Traefik and moving to a Cilium-centric setup, once you reintroduce Ingress traffic, you also need to pay attention to ",[85,598,599],{},"externalTrafficPolicy",". Per the official Kubernetes documentation, ",[85,602,603],{},"externalTrafficPolicy: Cluster"," (the default) can forward traffic to pods on any node in the cluster at the cost of an extra hop, while ",[85,606,607],{},"externalTrafficPolicy: Local"," forwards only to pods on the same node, preserving the client IP (",[33,610,613],{"href":611,"rel":612},"https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Freference\u002Fnetworking\u002Fvirtual-ips\u002F#external-traffic-policy",[37],"Kubernetes official: Virtual IPs and Service Proxies",[11,615,616,617,620,621,623,624,628],{},"K3s's official documentation recommends not setting ",[85,618,619],{},"node-external-ip"," on any node when you need ",[85,622,607],{}," to preserve the client source IP in NAT environments such as public clouds (",[33,625,627],{"href":215,"rel":626},[37],"SUSE official K3s documentation","). This constraint comes from the Kubernetes Service specification itself, so it doesn't go away just because you've switched to Cilium's eBPF load balancer.",[11,630,631,632,635],{},"Working through these configuration differences one by one takes real time, even for infrastructure engineers experienced with standard on-prem K8s operations. ",[33,633,588],{"href":586,"rel":634},[37],"'s Captain UI provides a visualized management console that lets you check the state of ServiceLB and kube-proxy without turning the cluster into a black box.",[22,637,639],{"id":638},"_5-pre-production-checklist","5. Pre-Production Checklist",[11,641,642],{},"Before putting a K3s + Cilium kube-proxy replacement setup into production, check at minimum the following items.",[644,645,646,656,665,673,678,686],"ul",{},[647,648,649,652,653,655],"li",{},[193,650,651],{},"Is ServiceLB fully disabled?"," Confirm ",[85,654,573],{}," returns nothing",[647,657,658,661,662],{},[193,659,660],{},"Are k8sServiceHost\u002Fk8sServicePort set in the Cilium Helm values?"," Check with ",[85,663,664],{},"helm get values cilium -n kube-system",[647,666,667],{},[193,668,669,670,672],{},"Does ",[85,671,569],{}," show the NodePort entry?",[647,674,675],{},[193,676,677],{},"Does the Pod CIDR match K3s's default (10.42.0.0\u002F16) or your custom value?",[647,679,680],{},[193,681,682,683,685],{},"Does the intended ",[85,684,599],{}," (Cluster\u002FLocal) match your Ingress\u002FLoadBalancer setup?",[647,687,688,691,692,696],{},[193,689,690],{},"Did kube-proxy and Cilium ever run simultaneously during migration, even briefly?"," (As ",[33,693,695],{"href":260,"rel":694},[37],"Cilium's official documentation"," warns, this can break connections due to NAT table inconsistencies)",[11,698,699,700,703],{},"Verifying each of these items one by one is exactly the kind of work that tends to become tribal knowledge. With ",[33,701,588],{"href":586,"rel":702},[37],"'s AI-Driven Deployment, this verification and configuration-gap analysis can be handed off to AI, letting you run a full K3s-based Kubernetes cluster starting at roughly ¥48,000 per month.",[22,705,707],{"id":706},"summary","Summary",[11,709,710],{},"Trying to replace kube-proxy with Cilium on K3s can break NodePort due to K3s-specific defaults the official steps don't mention — a lingering ServiceLB, Traefik's dependency on it, and missing k8sServiceHost\u002Fk8sServicePort settings. The issue isn't that Cilium's instructions are wrong; it's that K3s's bundled networking components weren't fully disabled. By disabling ServiceLB and Traefik, explicitly setting the required Cilium Helm values, and verifying NodePort connectivity step by step, you can run the same eBPF-based networking on K3s that you'd get on a standard Kubernetes cluster.",[11,712,713,714,717],{},"In the world of managed Kubernetes, you no longer have to put up with the high cost, complexity, and lock-in of EKS or AKS. With K3s-based ",[33,715,588],{"href":586,"rel":716},[37],", you can run genuine CNCF projects like Cilium exactly as they're meant to work, at dramatically better cost efficiency.",[719,720,721],"style",{},"html pre.shiki code .sE3pS, html code.shiki .sE3pS{--shiki-default:#C0CAF5}html pre.shiki code .sT800, html code.shiki .sT800{--shiki-default:#E0AF68}html pre.shiki code .sPY7s, html code.shiki .sPY7s{--shiki-default:#9ECE6A}html pre.shiki code .sAklC, html code.shiki .sAklC{--shiki-default:#89DDFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sbD-w, html code.shiki .sbD-w{--shiki-default:#51597D;--shiki-default-font-style:italic}html pre.shiki code .s0U2E, html code.shiki .s0U2E{--shiki-default:#F7768E}html pre.shiki code .sOJ5S, html code.shiki .sOJ5S{--shiki-default:#FF9E64}html pre.shiki code .sGX4V, html code.shiki .sGX4V{--shiki-default:#A9B1D6}",{"title":83,"searchDepth":150,"depth":150,"links":723},[724,725,730,735,736,737],{"id":24,"depth":150,"text":25},{"id":66,"depth":150,"text":67,"children":726},[727,728,729],{"id":208,"depth":169,"text":209},{"id":232,"depth":169,"text":233},{"id":245,"depth":169,"text":246},{"id":273,"depth":150,"text":274,"children":731},[732,733,734],{"id":280,"depth":169,"text":281},{"id":360,"depth":169,"text":361},{"id":503,"depth":169,"text":504},{"id":592,"depth":150,"text":593},{"id":638,"depth":150,"text":639},{"id":706,"depth":150,"text":707},"2026-11-07","We followed the official Cilium guide to enable kube-proxy replacement on K3s, and NodePort traffic suddenly stopped reaching our pods. The cause: K3s-specific defaults (Flannel, ServiceLB) that the generic docs never mention. Here's the fix and a pre-production checklist.","md","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-cilium-kube-proxy-replacement-nodeport-unreachable\u002Ftitle.webp","en",{},"\u002Fblog\u002Fen\u002Fk3s-cilium-kube-proxy-replacement-nodeport-unreachable",{"title":5,"description":739},"blog\u002Fen\u002Fk3s-cilium-kube-proxy-replacement-nodeport-unreachable",[748,749,519,750,751,752],"k3s","kubernetes","ebpf","kube-proxy","networking","OgedXm7rCijpsJphp1ybjEzTLACaUPfS9TrHiQBkukI",[755,765,774,783,791,798],{"path":756,"title":757,"description":758,"date":759,"tags":760},"\u002Fblog\u002Fen\u002Fk3s-vs-kubernetes-cni-flannel-default-comparison","K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are","K3s ships with Flannel built in, while standard Kubernetes starts with no CNI selected at all. This comparison, grounded in the official K3s, Kubernetes, Calico, and Cilium docs, explains how that difference affects NetworkPolicy enforcement and network performance.","2026-10-20",[748,749,761,762,763,519,764,752],"cni","flannel","calico","networkpolicy",{"path":766,"title":767,"description":768,"date":769,"tags":770},"\u002Fblog\u002Fen\u002Fcilium-ebpf-kubernetes-networking","Revolutionizing Kubernetes Networking with Cilium and eBPF","Discover how Cilium uses eBPF to transform Kubernetes networking. Compare with traditional CNIs, explore L7 policies, and leverage Hubble for observability.","2026-05-27",[519,750,749,752,761,771,772,773],"cncf","security","hubble",{"path":775,"title":776,"description":777,"date":778,"tags":779},"\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap","Ingress Is Ending. We Migrated to Gateway API, and K3s's Traefik Only Got Us Halfway","Migrating to Gateway API on K3s sounds simple since Traefik ships by default, but it still requires installing CRDs, rebuilding canary configs, and re-checking cert-manager wiring. A practical guide grounded in the 2026 Ingress-nginx retirement and Kubernetes 1.36.","2026-10-10",[748,749,780,781,782,752],"gateway-api","traefik","ingress",{"path":784,"title":785,"description":786,"date":787,"tags":788},"\u002Fblog\u002Fen\u002Fk3s-flannel-vxlan-overlay-mtu-troubleshooting","Ping Works, HTTP Hangs: Why K3s Flannel VXLAN Overlay Networks Break Over MTU","In a K3s cluster, ping succeeds but HTTP requests just hang — the culprit may be an MTU mismatch inside your VXLAN overlay network. This guide covers Flannel\u002FCalico MTU design, the PMTU blackhole phenomenon, and a step-by-step diagnostic process.","2026-09-01",[748,749,752,789,762,790],"vxlan","mtu",{"path":792,"title":793,"description":794,"date":795,"tags":796},"\u002Fblog\u002Fen\u002Fkubernetes-cni-overlay-network-troubleshooting-ospf","OSPF Fixes Itself in a Minute — Why Does a Kubernetes CNI Outage Take Half a Day?","Why does troubleshooting a Kubernetes overlay network take so long? This article breaks down how CNI works, the differences between Flannel VXLAN and Calico BGP, and the step-by-step process for isolating MTU mismatches that every K3s operator should know.","2026-08-16",[748,749,761,797,752],"overlay-network",{"path":799,"title":800,"description":801,"date":802,"tags":803},"\u002Fblog\u002Fen\u002Fkubernetes-ebpf-inspektor-gadget-observability","No strace. No Sidecars. Still Debuggable: Inspektor Gadget's Answer for Seeing Inside Kubernetes with eBPF","When you can't add a privileged container or inject a sidecar into a production Kubernetes cluster, how do you diagnose Pod traffic and syscalls? We explain how the eBPF tool Inspektor Gadget works, and what happened to it in 2026.","2026-08-15",[748,749,750,804,771],"observability",1794305507732]