cilium

Diagnose and configure Cilium networking for K3s clusters.

1|Updated Apr 3, 2026
One-click install
npx skills add https://github.com/villadalmine/infra --skill cilium
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: cilium
Source: https://github.com/villadalmine/infra/tree/main/.agents/skills/cilium
Command: npx skills add https://github.com/villadalmine/infra --skill cilium

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires kubectl, cilium, and includes scripts (resource) components.

What problem does it solve?

This Skill helps you operate and troubleshoot Cilium on K3s when cluster networking, load balancer IP assignment, or ingress behavior becomes difficult to diagnose. It turns low-level Cilium state into clear next steps for an ARM64 homelab cluster.

Core Features & Use Cases

  • kube-proxy replacement checks: Validate that Cilium is correctly handling service routing, BPF behavior, and masquerading.
  • Gateway API and ingress troubleshooting: Confirm Envoy CRDs, GatewayClass status, and shared or dedicated ingress exposure.
  • Load balancer and LAN advertising: Inspect LB-IPAM pools, external IP assignment, and L2 announcements for DNS and HTTP VIPs.
  • Upgrade and failure recovery: Detect stale operator pods, pending Helm upgrades, and rollout issues after configuration changes.
  • Use case: When a GatewayClass stays Unknown or a LoadBalancer service never gets an IP, use this Skill to identify the missing pool, stale pod, or traffic-policy mismatch.

Quick Start

Ask the assistant to inspect the current Cilium deployment, report networking health, and recommend the next fix for any kube-proxy, Gateway API, LB-IPAM, or L2 announcement issue.

Frequently Asked Questions about cilium

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why does my Kubernetes LoadBalancer service never get an external IP with Cilium on K3s?

Cilium LoadBalancer services fail to get external IPs when LB-IPAM pools are missing or misconfigured. This Skill inspects your LB-IPAM pool allocation and L2 announcements to identify the missing pool or stale operator pod preventing IP assignment.

How do I troubleshoot a Cilium GatewayClass stuck in Unknown status on K3s?

GatewayClass stays Unknown when Envoy CRDs are missing or the Cilium operator is stale. This Skill checks Gateway API CRDs, GatewayClass status, and operator rollout health to pinpoint the configuration or pod issue blocking ingress readiness.

How do I verify kube-proxy replacement is working correctly in Cilium?

Kube-proxy replacement requires validating Cilium BPF behavior, service routing, and masquerading rules. This Skill inspects the Cilium deployment state and BPF maps on K3s to confirm service routing is correctly handled without kube-proxy.

Does this Cilium troubleshooting Skill support ARM64 homelab K3s clusters?

Yes, Cilium troubleshooting for ARM64 homelab deployments is explicitly supported. This Skill diagnoses L2 announcements, LB-IPAM, and Gateway API issues specific to K3s clusters running on ARM64 architecture.

What should I do when Cilium Helm upgrades fail or leave pending rollout states on K3s?

Pending Cilium Helm upgrades usually involve stale operator pods or conflicting CRD leases. This Skill detects pending Helm upgrades, stale pods, and rollout issues after configuration changes to recommend the next recovery step.