{"slug": "cilium", "name": "Cilium", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 3, "commenters": 6, "warners": 1, "score": 2.165, "rising": -0.98, "first": "2025-11-13", "latest": "2026-03-10", "why": "I use Cilium with these features for custom made k8s clusters with Talos OS without any kube-proxy.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 2, "compare": 0, "warn": 1}, "spark": [1, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I use Cilium with these features for custom made k8s clusters with Talos OS without any kube-proxy.", "kind": "", "icon": true, "domain": "cilium.io", "github_repo": null, "official_url": "https://cilium.io/", "pricing": "", "aliases": ["Cilium"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 746781024, "item_id": 46673814, "url": "https://news.ycombinator.com/item?id=46673814", "by": "shivanshvij", "date": "2026-01-18", "version": null, "stance": "recommend", "quote": "Cilium is definitely the gold standard if you\u2019re working with Kubernetes clusters and need a full CNI", "excerpt": "Founder of loophole labs here! Cilium is definitely the gold standard if you\u2019re working with Kubernetes clusters and need a full CNI, but if you want to extend CNI functionality without replacing it, then this approach is the only option. It works quite well because Cillium (and all CNIs that I\u2019m aware of) don\u2019t use XDP like the blog post mentions, they use Netkit instead which is an alternative to veth designed for ", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Spliff \u2013 Correlating XDP and TLS via eBPF (Building a Linux EDR)"}, {"id": 746653152, "item_id": 46665822, "url": "https://news.ycombinator.com/item?id=46665822", "by": "spliffedr", "date": "2026-01-18", "version": null, "stance": "recommend", "quote": "I use Cilium with these features for custom made k8s clusters with Talos OS without any kube-proxy.", "excerpt": "I think (not 100% sure) Cillium [0][1] kinda already does this. This loophole is good for packet processing/routing and even introducing XDP based ACL to bypass any ip/nf tables and get that almost wire speed benefit. I use Cilium with these features for custom made k8s clusters with Talos OS without any kube-proxy. [0]https://docs.cilium.io/en/stable/operations/performance/tuning.html [1]https://isovalent.com/blog/p", "context": "runs custom k8s clusters", "use_case": "Kubernetes networking with XDP", "switched_from": "kube-proxy", "story": "Show HN: Spliff \u2013 Correlating XDP and TLS via eBPF (Building a Linux EDR)"}, {"id": 735545121, "item_id": 45971570, "url": "https://news.ycombinator.com/item?id=45971570", "by": "matt-p", "date": "2025-11-18", "version": null, "stance": "recommend", "quote": "Works fine, no need to require dhcp6.", "excerpt": "Yeah that obviously only works on /56 and above because networks should be a minimum of /64. I use k3s and each host has a /64; cilium just gives each pod a /80 and the host does NDP and stuff. Works fine, no need to require dhcp6.", "context": "", "use_case": "pod networking", "switched_from": "", "story": "A day at Hetzner Online in the Falkenstein data center"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 736572560, "item_id": 46035785, "url": "https://news.ycombinator.com/item?id=46035785", "by": "__turbobrew__", "date": "2025-11-24", "version": null, "stance": "warn", "quote": "cilium falls apart at around a few thousand nodes", "excerpt": "When I was involved about a year ago, cilium falls apart at around a few thousand nodes. One of the main issues of cilium is that the bpf maps scale with the number of nodes/pods in the cluster, so you get exponential memory growth as you add more nodes with the cilium agent on them. https://docs.cilium.io/en/stable/operations/performance/scalability/report/", "context": "", "use_case": "Kubernetes cluster networking", "switched_from": "", "story": "Building the largest known Kubernetes cluster"}]}], "who": [{"by": "spliffedr", "context": "runs custom k8s clusters", "url": "https://news.ycombinator.com/item?id=46665822", "date": "2026-01-18"}, {"by": "nullify88", "context": "runs a home lab", "url": "https://news.ycombinator.com/item?id=45913852", "date": "2025-11-13"}], "tags": [], "use_cases": ["cluster networking", "kubernetes networking with xdp", "kubernetes cluster networking", "pod networking", "home lab kubernetes networking"], "compared": [{"slug": "talos-linux", "name": "Talos Linux", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=46663319", "title": "Show HN: Spliff \u2013 Correlating XDP and TLS via eBPF (Building a Linux EDR)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=47322539", "title": "Single command deployment of a Gitops Talos Kubernetes cluster on Proxmox", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46006891", "title": "Building the largest known Kubernetes cluster", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45968235", "title": "A day at Hetzner Online in the Falkenstein data center", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45902604", "title": "Helm 4.0", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1, "recommend": 1, "warn": 1}, "2025-12": {}, "2026-01": {"recommend": 2}, "2026-02": {}, "2026-03": {"neutral": 1}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 757160644, "item_id": 47322540, "url": "https://news.ycombinator.com/item?id=47322540", "by": "okwilkins", "date": "2026-03-10", "version": null, "stance": "neutral", "quote": "with ArgoCD and Cilium", "excerpt": "Just finished revamping my Kubernetes cluster, built on Talos OS and Proxmox. The cluster uses 2 N100 CPU-based mini PCs, both retrofitted with 32GB of RAM and 1TB of NVME SSDs. They are happily tucked away under my TV :). Last week I accidentally destroyed my cluster's data and had to rebuild everything from zero. Homelabs are made to be broken, I guess\u2026 but it made me realise how painful my old bootstrapping proces", "context": "", "use_case": "cluster networking", "switched_from": "", "story": "Single command deployment of a Gitops Talos Kubernetes cluster on Proxmox"}, {"id": 746781024, "item_id": 46673814, "url": "https://news.ycombinator.com/item?id=46673814", "by": "shivanshvij", "date": "2026-01-18", "version": null, "stance": "recommend", "quote": "Cilium is definitely the gold standard if you\u2019re working with Kubernetes clusters and need a full CNI", "excerpt": "Founder of loophole labs here! Cilium is definitely the gold standard if you\u2019re working with Kubernetes clusters and need a full CNI, but if you want to extend CNI functionality without replacing it, then this approach is the only option. It works quite well because Cillium (and all CNIs that I\u2019m aware of) don\u2019t use XDP like the blog post mentions, they use Netkit instead which is an alternative to veth designed for ", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Spliff \u2013 Correlating XDP and TLS via eBPF (Building a Linux EDR)"}, {"id": 746653152, "item_id": 46665822, "url": "https://news.ycombinator.com/item?id=46665822", "by": "spliffedr", "date": "2026-01-18", "version": null, "stance": "recommend", "quote": "I use Cilium with these features for custom made k8s clusters with Talos OS without any kube-proxy.", "excerpt": "I think (not 100% sure) Cillium [0][1] kinda already does this. This loophole is good for packet processing/routing and even introducing XDP based ACL to bypass any ip/nf tables and get that almost wire speed benefit. I use Cilium with these features for custom made k8s clusters with Talos OS without any kube-proxy. [0]https://docs.cilium.io/en/stable/operations/performance/tuning.html [1]https://isovalent.com/blog/p", "context": "runs custom k8s clusters", "use_case": "Kubernetes networking with XDP", "switched_from": "kube-proxy", "story": "Show HN: Spliff \u2013 Correlating XDP and TLS via eBPF (Building a Linux EDR)"}, {"id": 736572560, "item_id": 46035785, "url": "https://news.ycombinator.com/item?id=46035785", "by": "__turbobrew__", "date": "2025-11-24", "version": null, "stance": "warn", "quote": "cilium falls apart at around a few thousand nodes", "excerpt": "When I was involved about a year ago, cilium falls apart at around a few thousand nodes. One of the main issues of cilium is that the bpf maps scale with the number of nodes/pods in the cluster, so you get exponential memory growth as you add more nodes with the cilium agent on them. https://docs.cilium.io/en/stable/operations/performance/scalability/report/", "context": "", "use_case": "Kubernetes cluster networking", "switched_from": "", "story": "Building the largest known Kubernetes cluster"}, {"id": 735545121, "item_id": 45971570, "url": "https://news.ycombinator.com/item?id=45971570", "by": "matt-p", "date": "2025-11-18", "version": null, "stance": "recommend", "quote": "Works fine, no need to require dhcp6.", "excerpt": "Yeah that obviously only works on /56 and above because networks should be a minimum of /64. I use k3s and each host has a /64; cilium just gives each pod a /80 and the host does NDP and stuff. Works fine, no need to require dhcp6.", "context": "", "use_case": "pod networking", "switched_from": "", "story": "A day at Hetzner Online in the Falkenstein data center"}, {"id": 734621635, "item_id": 45913852, "url": "https://news.ycombinator.com/item?id=45913852", "by": "nullify88", "date": "2025-11-13", "version": null, "stance": "neutral", "quote": "Traefik and Cilium are the only helm charts I use", "excerpt": "Running my home lab at home, I've grown sick of constant Renovate PRs against the helm charts in use. I recall one \"minor\" update not long ago recently in CoreDNS was messing with the exposed ports in the service and installs broke for a lot of folks. If I need to run some software now, I `helm template` the resources and commit those to git. I'm so tired of some random \"Extended helm chart to customise labels / anno", "context": "runs a home lab", "use_case": "home lab Kubernetes networking", "switched_from": "", "story": "Helm 4.0"}]}