CNCF-hosted Co-located Events Europe 2025

Cilium’s out-of-the-box default settings prioritize compatibility over performance, making it easy to deploy and get started. However, for production-grade environments, it’s essential to tune the settings to unlock Cilium’s full potential for performance and scalability.

In this talk, we’ll explore settings and options that make a real difference, from eBPF-based host routing and kube-proxy replacement, to eBPF map sizing and multi-cluster setups. We’ll also look at cutting-edge features like BIG TCP and Netkit, and future performance features the project has on the roadmap. Whether you’re looking to optimize your performance or scale to the next level, we’ll provide the tools to get your Cilium environment running at top speed—without “waiting for the kettle to boil”!

Curious how Azure integrated our native IPAM implementation with Cilium through the power of open standards? The secret is "Delegated IPAM", a widely used part of the CNI specification. Unlike other IPAM implementations that embed vendor-specific code in Cilium itself, delegated IPAM allows seamless integration with any platform using out-of-tree plugins. Azure users benefit from fast, scalable IPAM and native routing that avoids the encapsulation overhead of Cilium tunnel mode. Delegated IPAM acts as a bridge combining the benefits of both worlds without any compromises. Session participants will learn how to leverage delegated IPAM to provide similar integrations for cloud or on-prem environments with zero changes in the Cilium code.

Cilium offers two options for storing security identities: KVStore mode and CRD mode. Both have their pros and cons when it comes to scalability, operational complexity and cost.

Previously, there wasn't a straightforward method to migrate live Kubernetes clusters between these two modes without incurring downtime. In this talk, we'll discuss the challenges Datadog faced and the upstream contributions we made in order to seamlessly migrate hundreds of clusters from KVStore to CRD mode without causing network disruptions for users.

Cilium is a leading CNCF project that has become the de-facto standard for Kubernetes networking. Among its many features is the Egress Gateway, which allows routing outgoing traffic from one or more workloads to a specific egress IP.
However, this feature lacks built-in high availability, and the egress IP must be managed externally. The Cilium HAEgress Operator (https://github.com/angeloxx/cilium-haegress-operator) addresses this limitation by providing a high-availability solution for egress traffic, ensuring continuity even in the event of node failures through dynamic virtual IP migration between nodes.
This lightning talk introduces the project, its current state, and future developments aimed at extending this standard Cilium feature.