Deploy kube-router CNI

kube-router is a turnkey CNI (Container Network Interface) solution for Kubernetes networking that provides pod networking, network policy enforcement, and service proxy using Linux kernel technologies (BGP, IPVS, IPTables, and eBPF).

Install kube-router CNI

When generating the machine config for a node, set the CNI to none and disable the default kube-proxy since kube-router replaces it.

Talos v1.14+
Talos < v1.14

For Talos v1.14 and later, delete the default CNI and disable kube-proxy:

cat <<'EOF' > patch.yaml
apiVersion: v1alpha1
kind: KubeFlannelCNIConfig
$patch: delete
---
apiVersion: v1alpha1
kind: KubeProxyConfig
enabled: false
EOF

On Talos versions earlier than v1.14, set the CNI to none and disable kube-proxy:

cat <<'EOF' > patch.yaml
cluster:
  network:
    cni:
      name: none
  proxy:
    disabled: true
EOF

Generate the machine config with the patch applied to the control plane:

talosctl gen config \
  <cluster-name> https://<cluster-endpoint>:6443 \
  --config-patch-control-plane @patch.yaml

If you want to use kube-router alongside kube-proxy instead of replacing it, omit proxy.disabled: true from the patch and set kubeRouter.run_router=--run-service-proxy=false in the kube-router DaemonSet arguments.

Installation

Choose the tab that matches how you manage your cluster.

Manifest install
Omni

kube-router can replace kube-proxy entirely, or run alongside it. Choose the tab that matches how you want to run it.

With kube-proxy
Without kube-proxy

Create a patch file that disables the default CNI. This keeps kube-proxy running, and uses kube-router for pod networking and network policies only:
cat <<EOF > patch.yaml cluster: network: cni: name: none EOF
Replace <CLUSTER_NAME> with a name for your cluster and <CLUSTER_ENDPOINT> with your control plane endpoint, then generate the machine config:
talosctl gen config \ <CLUSTER_NAME> <CLUSTER_ENDPOINT> \ --config-patch @patch.yaml

After applying the machine config and bootstrapping, Talos will appear to hang at phase 18/19 with the message retrying error: node not ready. This is expected — nodes are only marked ready once a CNI is running. You have about 10 minutes to apply kube-router before the node reboots to retry.

During this window, deploy kube-router:

kubectl apply -f https://raw.githubusercontent.com/cloudnativelabs/kube-router/master/daemonset/kubeadm-kuberouter.yaml

After kube-router is installed, the boot process continues and completes.

Create a patch file that disables the default CNI and kube-proxy — kube-router replaces both:

cat <<EOF > patch.yaml
cluster:
  network:
    cni:
      name: none
  proxy:
    disabled: true
EOF

Replace <CLUSTER_NAME> with a name for your cluster and <CLUSTER_ENDPOINT> with your control plane endpoint, then generate the machine config:
talosctl gen config \ <CLUSTER_NAME> <CLUSTER_ENDPOINT> \ --config-patch @patch.yaml

During this window, deploy kube-router with all features (pod networking, network policies, and service proxy):
kubectl apply -f https://raw.githubusercontent.com/cloudnativelabs/kube-router/master/daemonset/kubeadm-kuberouter-all-features.yaml
After kube-router is installed, the boot process continues and completes.

If you are using Omni, deploy kube-router using the manifest sync feature.kube-router can replace kube-proxy entirely, or run alongside it. Choose the tab that matches how you want to run it.

With kube-proxy
Without kube-proxy

Download the kube-router manifest:

curl -Lo kube-router.yaml https://raw.githubusercontent.com/cloudnativelabs/kube-router/master/daemonset/kubeadm-kuberouter.yaml

Reference the manifest in your Omni cluster template using the file field. The template’s patches block disables the default CNI and leaves kube-proxy running:

Apply the cluster template:
omnictl cluster template sync --file cluster-template.yaml
Omni waits until the Kubernetes API is available and the cluster is healthy before applying the kube-router manifest. See Sync Kubernetes manifests for more on manifest sync modes and status monitoring.

Download the kube-router manifest:

curl -Lo kube-router.yaml https://raw.githubusercontent.com/cloudnativelabs/kube-router/master/daemonset/kubeadm-kuberouter-all-features.yaml

Reference the manifest in your Omni cluster template using the file field. The template’s patches block disables the default CNI and kube-proxy:

For Talos v1.14 and later:On Talos versions earlier than v1.14:

Apply the cluster template:
omnictl cluster template sync --file cluster-template.yaml
Omni waits until the Kubernetes API is available and the cluster is healthy before applying the kube-router manifest. See Sync Kubernetes manifests for more on manifest sync modes and status monitoring.

Cleanup of kube-proxy

If you deployed kube-router as a replacement for kube-proxy and kube-proxy was previously running, clean up the iptables rules left behind:

kubectl -n kube-system delete ds kube-proxy
kubectl -n kube-system delete cm kube-proxy

Refer to the kube-router user guide for more configuration options.

Overview

CNI

CSI

Security

Monitoring & Observability

Advanced Guides

Install kube-router CNI

Installation

Cleanup of kube-proxy

​Install kube-router CNI

​Installation

​Cleanup of kube-proxy

Install kube-router CNI

Installation

Cleanup of kube-proxy