I Replaced kube-proxy with eBPF in Production (And Why My Monitoring Went Blind for 6 Hours)
I Replaced kube-proxy with eBPF in Production (And Why My Monitoring Went Blind for 6 Hours) From a "simple" Cilium upgrade to a 6-hour outage where my SIEM couldn't see a single packet — the real story of deleting kube-proxy, the invisible eBPF datapath, and why the docs never warned me about the one metric that matters. The Setup It started with a cilium upgrade command I ran on a Tuesday…
In a production environment, a system administrator replaced the kube-proxy component with eBPF in Cilium. The upgrade occurred on a Tuesday evening, and initially, everything seemed to function as expected. However, at 2:47 AM, an unusual alert was received by the monitoring system - the SIEM. The absence of data from the SIEM led to a 6-hour outage, with the security information and event management system unable to detect any packets.
This incident highlighted the importance of monitoring the one metric that mattered: the connection tracking visibility provided by the iptables rules in kube-proxy.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
