Replace kube-proxy with Cilium in a running Kubernetes cluster

Check the baseline first

Before making any changes, let's verify basic cluster networking:

kubectl create deployment nginx --image=nginx
kubectl expose deployment nginx --name=nginx-service --port=80 --target-port=80 --type=ClusterIP

Test it with wget http://<serviceIP>:<port>.

Remove kube-proxy and install Cilium

Before installing Cilium, make sure no other CNI (like Flannel) is running. Cilium and Flannel should not run together in the same cluster: doing so can lead to networking conflicts, unpredictable behaviour and broken connectivity.

kubectl delete daemonset kube-proxy -n kube-system
kubectl delete daemonset kube-flannel-ds -n kube-system
helm repo add cilium https://helm.cilium.io/
helm repo update
helm install cilium cilium/cilium \
  --version 1.14.5 \
  --namespace kube-system \
  --set kubeProxyReplacement=strict \
  --set k8sServiceHost=<API_SERVER_IP> \
  --set k8sServicePort=6443 \
  --set bpf.masquerade=true \
  --set nodeinit.enabled=true \
  --set ipam.mode=kubernetes \
  --set hubble.enabled=true \
  --set hubble.relay.enabled=true \
  --set hubble.ui.enabled=true

Notes

• The kubeProxyReplacement mode must be enabled when installing Cilium. This fully replaces kube-proxy functionality using eBPF.
• Make sure all Cilium pods are running before testing any workloads.
• After removing kube-proxy and before installing Cilium, you can test service reachability. It should fail, as no service routing is in place.
• However, I observed that existing kube-proxy rules sometimes linger on the nodes for a while, which can still let connections succeed.
• To get a clean test, roll out your test application again after removing kube-proxy, so it follows the current networking rules.
• Best practice for production: avoid transitional states. Deploy Cilium with kube-proxy replacement from the beginning, and skip installing kube-proxy entirely with kubeadm init --skip-phases=addon/kube-proxy. Multiple CNIs in one cluster will conflict.

Cilium makes it simple: no need for the kube-proxy add-on.