Inspect and prune Cilium BPF conntrack table on busy nodes

The cilium bpf ct list command dumps the eBPF connection tracking table, showing each flow's source, destination, protocol, and state. Internally the table is a BPF hash map (cilium_ct4_global or cilium_ct6_global) that the datapath updates on every new flow; the agent exposes it through the cilium CLI. On nodes with high connection churn, the table can fill up, causing new connections to be dropped with CT_MAP_LOOKUP_FAIL errors.

In production this is used to diagnose NAT exhaustion, to identify which workloads are creating excessive flows, and to tune the table size. It is also used before enabling KubeProxyReplacement strict mode, because strict mode shifts more traffic into conntrack. When the table is full, cilium bpf ct flush can be used to clear stale entries, but this should be done with care because it disrupts active connections.

Security-wise, dumping conntrack entries reveals internal IP/port pairs and can help an attacker map the network, so restrict access. Performance impact of listing is moderate; the flush operation can cause a brief spike in packet drops. Common pitfalls include flushing during peak traffic, which breaks long-lived connections, and not tuning bpf.ctTcpMax and bpf.ctAnyMax after a flush, which causes the table to fill again within minutes. Always monitor cilium_bpf_map_pressure before and after.

> System.Execute()

# List current conntrack entries
kubectl -n kube-system exec ds/cilium -- cilium bpf ct list global | head -100

# Check table pressure
kubectl -n kube-system exec ds/cilium -- cilium bpf ct list global | wc -l

# Flush only TCP entries (use with caution in production)
kubectl -n kube-system exec ds/cilium -- cilium bpf ct flush global --protocol tcp

# Tune map sizes via Helm
helm upgrade cilium cilium/cilium --namespace kube-system --reuse-values \
  --set bpf.ctTcpMax=524288 \
  --set bpf.ctAnyMax=262144

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-6A00F48F064C