How-To Configure Proxy Load Balancing for Kubernetes Services Using Cilium CNI

Last Updated: Nov 10, 2025

Introduction

By default, Crusoe Managed Kubernetes (CMK) clusters use the Cilium CNI for networking. This standard configuration does not include Envoy proxy integration, which limits the available service load balancing algorithms to maglev and random (the default). While these options are robust, your workload may benefit from more sophisticated traffic distribution strategies. By enabling Envoy within the Cilium configuration, you can unlock additional load balancing algorithms better suited for specific use cases.

This guide explains how to configure Proxy Load Balancing for Kubernetes services using Cilium, which is useful for use cases such as gRPC load-balancing. Once enabled, the traffic to a Kubernetes service will be redirected to a Cilium-managed Envoy proxy for load balancing.
 
⚠️ WARNING: Enabling Envoy and/or updating the load balancing algorithm will restart the CNI, causing a temporary disruption to running jobs.

Prerequisites

• Access to the Crusoe CLI
• Valid Crusoe authentication credentials
• An existing Crusoe Managed Kubernetes (CMK) cluster
• Helm installed on your local machine

Step-by-Step Instructions

The following instructions enable Envoy proxy load balancing and configure the least_request traffic distribution algorithm for your Kubernetes services. You can choose from three available algorithms: least_request, round_robin (default), or random.

1. Install Cilium CLI on your local system by referring to the following link: https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/#install-the-cilium-cli 

2. Set the Kubeconfig environment variable to point to your cluster:

   export KUBECONFIG=<path-to-your-kubeconfig>

3. Add the Cilium Helm Repository

   helm repo add cilium https://helm.cilium.io

4. Retrieve Existing Cilium Values and export it to a file:

   helm get values -n kube-system cilium | grep -v "USER-SUPPLIED VALUES:" > cilium-values.yaml

5. Append the following configuration to cilium-values.yaml:

   envoy:
     enabled: true 
   loadBalancer:
     l7:
       backend: envoy
       algorithm: least_request 

6. Note down Cilium chart version

   helm list -n kube-system | grep -i cilium

7. Upgrade the Cilium helm release by specifying the chart version

   helm upgrade -n kube-system cilium cilium/cilium --values ./cilium-values.yaml --version 1.16.1

Once Envoy is enabled, a new cilium-envoy DaemonSet should be created, confirming that the Envoy proxy is active.

$ kubectl get ds -n kube-system                        
NAME           DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR            AGE
cilium         3         3         0       3            0           kubernetes.io/os=linux   81m
cilium-envoy   3         3         3       3            3           kubernetes.io/os=linux   19m

If the Cilium DaemonSet logs show an error like the following, it means the required Custom Resource Definitions (CRDs) haven't been registered by the Cilium Operator yet.

time="2025-09-18T08:55:21Z" level=info msg="Still waiting for Cilium Operator to register the following CRDs: [crd:ciliumclusterwideenvoyconfigs.cilium.io crd:ciliumenvoyconfigs.cilium.io]" subsys=k8s

To resolve this, follow the steps below to restart both the Cilium Operator and the Cilium DaemonSet.

⚠️ WARNING: Restarting the Cilium Operator will restart the CNI plugin, which may cause a temporary disruption to running workloads.

$ kubectl rollout restart -n kube-system deploy/cilium-operator
deployment.apps/cilium-operator restarted

---

$ kubectl rollout restart -n kube-system daemonset/cilium
daemonset.apps/cilium restarted

Once restarted, the Cilium operator and DaemonSet pods should be restarted and running, as shown below:

$ kubectl get pods -n kube-system | grep cilium
cilium-dbmts                                              1/1     Running   0               22s
cilium-envoy-d4h6l                                        1/1     Running   0               2m48s
cilium-envoy-dltgg                                        1/1     Running   0               2m48s
cilium-nlnhb                                              1/1     Running   0               22s
cilium-operator-fd5c65c8-4zzt4                            1/1     Running   0               53s
cilium-operator-fd5c65c8-cmkzj                            1/1     Running   0               53s

Test the proxy

You can verify that incoming requests are routed to the Kubernetes service through the proxy by following the steps outlined here. 

Additional Resources

• Crusoe Managed Kubernetes
• Cilium Installation Docs
• Envoy Proxy Injection Versus Standalone DS
• Testing Cilium Envoy Proxy Load Balancing for Kubernetes Services
• kubectl annotate