k8s集群网络从cilium集群迁移至calico集群后发现集群网络中pod->service部分网络不通，经过排查发现是cilium ebpf程序未卸载干净。经过各种折腾，终于成功。以下步骤均需在每个节点执行。
1 移除iptable，虚拟网卡
iptables -t filter -F
iptables -t filter -X
iptables -t filter -Z
iptables -t raw -F
iptables -t raw -X
iptables -t raw -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
for link_name in $(ip link | grep -Ei "lxc|cilium|cali|dumm|ipvs|veth" | awk -F ':' '{print $2}' | awk -F '@' '{print $1}' | xargs );do echo $link_name;ip link delete $link_name;done
2 删除cilium tc xdp ebpf程序
# 执行命令，将其中cilum image替换为自己的
sudo docker run -it -v /run/cilium/cgroupv2/:/run/cilium/cgroupv2/ -v /sys/fs/bpf:/sys/fs/bpf -v /sys/fs/cgroup/:/sys/fs/cgroup/ --privileged --net=host harbor.cars.rails.cn/k8s/cilium:v1.11.9 -- cilium cleanup -f --all-state
3 删除cilium socket ebpf程序
执行命令，进入容器，将其中cilum image替换为自己的
docker run -it -v /run/cilium/cgroupv2/:/run/cilium/cgroupv2/ -v /sys/fs/bpf:/sys/fs/bpf -v /sys/fs/cgroup/:/sys/fs/cgroup/ --privileged --net=host harbor.cars.rails.cn/k8s/cilium:v1.11.9 -- bash
安装依赖
sed -i "s@http://.*archive.ubuntu.com@https://mirrors.tuna.tsinghua.edu.cn@g" /etc/apt/sources.list
sed -i "s@http://.*security.ubuntu.com@https://mirrors.tuna.tsinghua.edu.cn@g" /etc/apt/sources.list
apt update && apt install -y jq vim
执行脚本
#!/usr/bin/env bash
if [[ "${EUID}" -ne 0 ]]; then
echo "This script must be run as root"
exit 1
fi
while read -r cgroup_json; do
echo $cgroup_json
cgroup="$(jq -r .cgroup <<<"${cgroup_json}")"
# Don't want to detach systemd programs. Cilium attaches its program at the root and under docker.
while read -r id attach_type; do
bpftool cgroup detach "${cgroup}" "${attach_type}" id "${id}"
done < <(jq -r '.programs[] | [.id,.attach_type] | @tsv' <<<"${cgroup_json}")
done < <(bpftool cgroup tree -j | jq -c '.[]')
执行命令
cilium cleanup
