I Replaced kube-proxy with eBPF in Production (And Why My Monitoring Went Blind for 6 Hours)
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Production eBPF migration war story with monitoring failure, deeply technical and actionable for cloud infrastructure engineers.
Replacing kube-proxy with Cilium's eBPF kube-proxy replacement in a 4-node homelab cluster (Talos Linux, Cilium 1.16) caused a 6-hour SIEM blackout because the eBPF datapath bypasses iptables hooks that security monitoring tools rely on for packet capture. The upgrade from Cilium 1.15 partial mode to full eBPF replacement removed iptables rules entirely, breaking network flow and audit log ingestion without affecting cluster health. The author's postmortem highlights that eBPF-based load balancing provides better scalability (avoiding iptables-restore locks on Raspberry Pi) but requires re-architecting observability pipelines to tap BPF hooks instead of kernel netfilter.