Skip to content

TikTok's IPv6 Journey To Cilium: Pitfalls and Lessons Learned#

KubeCon + CloudNativeCon North America 2025 digest Program Core pick 10–13 November 2025

Recording

Giri Kuncoro & Joseph Pallamidessi, TikTok — Core

Play the recording: TikTok's IPv6 Journey To Cilium: Pitfalls and Lessons Learned

  • Why: An IPv6-only production datacenter is still rare, and Cilium's battle-testing has overwhelmingly been on IPv4 / dual-stack. This is a concrete report of what actually breaks at the datapath when you remove IPv4 entirely — directly relevant to anyone planning a v6-only fabric.
  • What: A migration account of moving global, IPv6-only clusters to Cilium, enumerating specific failures rather than a success story. (from abstract only)
  • How: Native routing mode was mandatory because Cilium does not tunnel over IPv6; they then hit a sequence of v6-only bugs — NDP traffic dropped by network policy due to incorrect identity resolution, DNS policy not permitting IPv6 DNS servers, debug tooling broken when IPv4 BPF maps are absent, plus a NodePort timeout issue. (from abstract only)
  • Where applicable: IPv6-only Kubernetes on Cilium specifically; the failure modes are general to v6-only Cilium deployments, not TikTok-specific infrastructure. A practical pre-flight checklist for that migration.