Engineer Replaces kube-proxy with eBPF in Homelab Cluster, Loses Monitoring for 6 Hours

A software engineer upgraded Cilium from version 1.15 to 1.16 on a four-node bare-metal homelab cluster running Talos Linux, enabling full eBPF-based kube-proxy replacement by setting a single configuration flag. The change appeared successful at first — all pods remained running and the cluster showed healthy status — but at 2:47 AM an alert revealed that the SIEM had received zero network flow or Kubernetes audit logs since the upgrade. The root cause was that the eBPF datapath bypasses the iptables and netfilter hooks that the security monitoring stack relied on to capture packet-level data. The engineer had migrated away from kube-proxy's iptables rules, which, while less scalable, fed the observability pipeline that the SIEM depended on. The incident highlighted a critical gap in Cilium's documentation: replacing kube-proxy with eBPF silently removes the datapath layer that many security and monitoring tools assume will always be present.