<p>I've read the cilium documents and the benchmark shows that cilium-proxy using ebpf is faster than kube-proxy ipvs mode. I'm not an expert on inner workings on ebpf or anything so it would be great if anyone could explain why cilium-proxy is faster than kube-proxy ipvs mode in detail.</p>

pandawithcat
<p>eBPF allows Cilium to hook into the kernel at lower point or higher points depending on the desired path.</p>
<p>For North/South traffic, Cilium can leverage XDP which sits right on top of the driver to forward packets without the need to allocate socket buffers and has a shorter code path overall. This <a href="https://cilium.io/blog/2020/06/22/cilium-18/" rel="nofollow noreferrer">link</a> has additional details.</p>
<p>In East/West traffic, especially if a pod needs to connect to another pod on the same node, Cillium can forward packets directly from one socket to another without having to go through the full network stack and lookup tables. Again, shortening the code path and thus decreasing CPU load. <a href="https://docs.cilium.io/en/v1.12/concepts/ebpf/lifeofapacket/#endpoint-to-endpoint" rel="nofollow noreferrer">Here</a> is a reference.</p>
<p>It all comes down to taking shortcuts to shorten code paths.</p>
