Michelin

Consolidating on Cilium: How Michelin replaced two CNIs and gained network visibility at scale

Challenge

In 2024, Michelin’s Container as a Service (CaaS) platform team underwent a full rebuild of the company’s Kubernetes platform using open source software, replacing a vendor-based solution that had become costly and constraining. The result, called Michelin Kubernetes Services (MKS), is detailed in a previous CNCF case study. The migration simplified cluster lifecycle management, but left significant gaps in networking. The primary issue was that the team had accumulated two different CNI plugins over the course of its migration: one that predated the vendor-managed Kubernetes solution, and one that came bundled with it. Running dual CNIs introduced operational complexity and, more critically, left the team with almost no visibility into what was happening on the network.

“Before Cilium we had no visibility at all,” said Arnaud Pons, Container as a Service Product Architect at Michelin. “Troubleshooting network problems was painful, and we had very few tools to help us do it.”

There was also a growing security requirement. Michelin’s security team needed to control which external services each namespace could reach, and to define those rules by domain name rather than IP address, so policies would remain stable as infrastructure changed. This was something their existing CNIs could not provide out of the box.

Solution

When the CaaS team began evaluating CNI options in early 2025, they defined three core requirements: robustness, observability, and support for DNS-based egress network policies. The team selected Cilium because it combined networking, observability, and security capabilities within a single CNCF project, reducing operational complexity while providing a consistent platform for future cloud native networking initiatives.  The team also saw the underlying eBPF technology as a game changer. 

As a CNCF Graduated project, Cilium provided Michelin with a mature, community-supported networking platform built on open standards and backed by a rapidly growing cloud native ecosystem.

Hubble, Cilium’s built-in observability layer, was one of the biggest draws. It provided the ability to log every connection, both pod-to-pod and pod-to-external, without any additional tooling. Cilium was also gaining momentum across the broader cloud native ecosystem, with major cloud providers adopting it as their default CNI. This served as a signal of production-readiness and long-term community support. “Cilium matched all the criteria we had,” said Pons. “We were seeing a lot of the community move to Cilium, and the fact that observability was included by default was really important for us.”

The migration began in Spring 2025 and was completed across approximately 70 to 80 clusters in roughly two months. The process was executed as a live migration, cluster by cluster, with Cluster API used to manage node-level changes within Michelin’s GitOps-driven infrastructure.

The migration was executed within Michelin’s Kubernetes and GitOps-based platform architecture, demonstrating how CNCF ecosystem projects can be combined to simplify large-scale infrastructure modernization initiatives.

No customers were impacted. “What impressed us most was how smooth the migration was,” said Pons. “There was no outage at all, and because of that our customers had no idea the network change was even happening.”

With the fleet consolidated into a single CNI, the team began integrating Cilium’s flow logs into Michelin’s existing monitoring tooling and rolling out DNS-based egress policies across namespaces, addressing security team requirements that had gone unaddressed for years.