k8s集群网络从cilium集群迁移至calico集群后发现集群网络中pod->service部分网络不通，经过排查发现是cilium ebpf程序未卸载干净。经过各种折腾，终于成功。以下步骤均需在每个节点执行。

1 移除iptable，虚拟网卡

 iptables -t filter -F                                                                                                                                        
 iptables -t filter -X                                                                                                                                               
 iptables -t filter -Z                                                                                                                                           
 iptables -t raw -F                                                                                                                                                         
 iptables -t raw -X                                                                                                                                                         
 iptables -t raw -Z                                                                                                                                                         
 iptables -t nat -F                                                                                                                                                         
 iptables -t nat -X                                                                                                                                                         
 iptables -t nat -Z                                                                                                                                                         
 iptables -t mangle -F                                                                                                                                                      
 iptables -t mangle -X                                                                                                                                                      
 iptables -t mangle -Z

for link_name in $(ip link | grep -Ei "lxc|cilium|cali|dumm|ipvs|veth" | awk -F ':' '{print $2}' | awk -F '@' '{print $1}'  | xargs );do echo $link_name;ip link delete $link_name;done

2 删除cilium tc xdp ebpf程序

# 执行命令，将其中cilum image替换为自己的
sudo docker run -it -v /run/cilium/cgroupv2/:/run/cilium/cgroupv2/ -v /sys/fs/bpf:/sys/fs/bpf -v /sys/fs/cgroup/:/sys/fs/cgroup/ --privileged --net=host harbor.cars.rails.cn/k8s/cilium:v1.11.9 -- cilium cleanup -f --all-state

3 删除cilium socket ebpf程序

执行命令，进入容器，将其中cilum image替换为自己的

 docker run -it -v /run/cilium/cgroupv2/:/run/cilium/cgroupv2/ -v /sys/fs/bpf:/sys/fs/bpf -v /sys/fs/cgroup/:/sys/fs/cgroup/ --privileged --net=host harbor.cars.rails.cn/k8s/cilium:v1.11.9 -- bash

安装依赖

sed -i "s@http://.*archive.ubuntu.com@https://mirrors.tuna.tsinghua.edu.cn@g" /etc/apt/sources.list
sed -i "s@http://.*security.ubuntu.com@https://mirrors.tuna.tsinghua.edu.cn@g" /etc/apt/sources.list
apt update && apt install -y jq vim

执行脚本

#!/usr/bin/env bash

if [[ "${EUID}" -ne 0 ]]; then
    echo "This script must be run as root"
    exit 1
fi

while read -r cgroup_json; do
    echo $cgroup_json
    cgroup="$(jq -r .cgroup <<<"${cgroup_json}")"
    # Don't want to detach systemd programs. Cilium attaches its program at the root and under docker.
    while read -r id attach_type; do
        bpftool cgroup detach "${cgroup}" "${attach_type}" id "${id}"
    done < <(jq -r '.programs[] | [.id,.attach_type] | @tsv' <<<"${cgroup_json}")
done < <(bpftool cgroup tree -j | jq -c '.[]')

执行命令

cilium cleanup