Service Mesh, Load Balancing, and Gateway API
This domain covers traffic handling in both directions: eBPF service load balancing that replaces kube-proxy, north-south ingress through Gateway API, and the L7 features that make Cilium a sidecar-free mesh.
Service load balancing
With kube-proxy replaced, services live in eBPF maps instead of iptables chains, so backend selection is a map lookup in the datapath. Key knobs: the algorithm (random by default, maglev for consistent hashing that minimises disruption when backends change), session affinity, and DSR, where the backend replies directly to the client and saves a hop. DSR requires an underlay that will not drop packets carrying pod source addresses.
A subtle point that is tested: for traffic from a pod on the same node, socket-level load balancing rewrites the destination at connect() time inside the pod's namespace. The packet leaves the pod already addressed to the backend, so tcpdump on the veth shows no service VIP and Hubble reports the backend rather than the ClusterIP.
North-south: Gateway API and LB IPAM
Cilium implements the Gateway API with gatewayAPI.enabled=true and the upstream CRDs installed: CiliumGatewayClass, Gateway, HTTPRoute, GRPCRoute, TLSRoute. LB IPAM hands out addresses from CiliumLoadBalancerIPPool; the L2 announcer answers ARP for them via CiliumL2AnnouncementPolicy, or the BGP control plane advertises them via CiliumBGPPeeringPolicy.
Mesh features
L7 policy and flow visibility are enforced by the embedded Envoy, per node, with no sidecar to inject. Workload mutual authentication via authentication.mutual.spire issues SPIFFE identities and gives mTLS without application changes.
Worked example
You create a Gateway and an HTTPRoute for /api, but the Gateway never receives an address and shows Programmed: False. Typical causes: no CiliumLoadBalancerIPPool matches the requested class, or the pool's CIDR overlaps an existing range and is therefore not selectable. Define a pool with a free CIDR and an CiliumL2AnnouncementPolicy naming the interfaces that should answer ARP; the address is then assigned and advertised.
Traps
Assuming Maglev is the default; enabling DSR without confirming the underlay tolerates pod source IPs; forgetting the Gateway API CRDs; expecting the Ingress controller to reconcile Gateway objects; and expecting ClusterIPs in Hubble for same-node service flows.