How-To Disable Cilium CNI Health Checks

Last Updated: Dec 17, 2025

Introduction

Cilium includes built-in cluster and endpoint health checks that continuously probe node-to-node and pod-to-pod connectivity using the cilium-health subsystem. These checks are useful for detecting datapath issues, but in some environments (for example, restricted networks, custom routing, or known benign failures), they may produce misleading alerts or unnecessary noise.

This article provides step-by-step instructions to safely disable Cilium health checks using Helm and verify that they are fully disabled using cilium status outputs.

⚠️ WARNING: Enabling or Disabling Cilium health checks will restart the CNI, causing a temporary disruption to running jobs.

Prerequisites

• Access to the Crusoe CLI
• Valid Crusoe authentication credentials
• An existing Crusoe Managed Kubernetes (CMK) cluster
• Helm installed on your local machine

Step-by-Step Instructions

1. Set the Kubeconfig environment variable to point to your cluster:

   $ export KUBECONFIG=<path-to-your-kubeconfig>

2. Add the Cilium Helm Repository

   $ helm repo add cilium https://helm.cilium.io

3. Retrieve Existing Cilium Values and export it to a file:

   $ helm get values -n kube-system cilium | grep -v "USER-SUPPLIED VALUES:" > cilium-values.yaml

4. Append the following configuration to cilium-values.yaml:

   ### Add the values below at the end of the file ###
   healthChecking: false
   endpointHealthChecking:
      enabled: false

5. Note down Cilium chart version

   $ helm list -n kube-system | grep -i cilium

6. Upgrade the Cilium helm release by specifying the chart version

   $ helm upgrade -n kube-system cilium cilium/cilium --values ./cilium-values.yaml --version 1.16.1

7. To ensure the new configuration is fully applied, restart both the Cilium Operator and the Cilium DaemonSet.

   ⚠️ WARNING: Restarting the Cilium Operator will restart the CNI plugin, which may cause a temporary disruption to running workloads.

   $ kubectl rollout restart -n kube-system deploy/cilium-operator
   deployment.apps/cilium-operator restarted
   
   ---
   
   $ kubectl rollout restart -n kube-system daemonset/cilium
   daemonset.apps/cilium restarted
    

Verification: Confirm Health Checks Are Disabled

Use the following steps to validate that Cilium health checks are disabled.

1. Exec into any cilium daemonset pod in kube-system namespace and run  cilium status:

   $ kubectl exec po/<cilium-daemonset-pod> -n kube-system -- cilium status | grep -i health

2. When health checks are disabled, cilium status will explicitly indicate that probes are disabled and will not show node or endpoint reachability tables.
   Example output (health checks disabled):

   Cluster health: Probe disabled
   For reference, When health checks are enabled, cilium status includes active probe results, for example:

   $ kubectl exec po/<cilium-daemonset-pod> -n kube-system -- cilium status | grep -i health
   
   Cilium health daemon: Ok 
   Controller Status: 107/107 healthy 
   Cluster health: 2/2 reachable (2025-12-18T05:24:45Z) 
   Modules Health: Stopped(0) Degraded(0) OK(79)

Additional Resources

• Crusoe Managed Kubernetes
• cilium status