diff --git a/kubernetes/defaults/main.yml b/kubernetes/defaults/main.yml
index 8f2be1d..28c0a60 100644
--- a/kubernetes/defaults/main.yml
+++ b/kubernetes/defaults/main.yml
@@ -23,7 +23,7 @@ kubernetes:
     #  can be used to remove filter
     clean_resolv_conf: false
 
-    # One of [flannel, calico]
+    # One of [none, flannel, calico, cilium]
     plugin: calico
 
     # Helper for networking
@@ -33,7 +33,7 @@ kubernetes:
       #  Helpful, when nodeIp_interface is a wireguard-interface
       routingtabletowg: false
 
-  # One of [traefik-ingress]
+  # One of [none, traefik-ingress, nginx-ingress]
   ingress_controller: traefik-ingress
 
   # k3s version to install, e.g. v1.37.1+k3s1. An installed k3s is replaced only
diff --git a/kubernetes/tasks/install/server/install_k3s.yml b/kubernetes/tasks/install/server/install_k3s.yml
index 83d1ae6..73d665a 100644
--- a/kubernetes/tasks/install/server/install_k3s.yml
+++ b/kubernetes/tasks/install/server/install_k3s.yml
@@ -41,5 +41,10 @@
   when:
     - "kubernetes.network.plugin == 'calico'"
 
+- name: Deploy cilium
+  import_tasks: ./roles/kubernetes/tasks/install/server/network-plugin/deploy_cilium.yml
+  when:
+    - "kubernetes.network.plugin == 'cilium'"
+
 - name: Deploy network-helpers
   import_tasks: ./roles/kubernetes/tasks/install/server/network-plugin/deploy_network_helper.yml
diff --git a/kubernetes/tasks/install/server/network-plugin/deploy_cilium.yml b/kubernetes/tasks/install/server/network-plugin/deploy_cilium.yml
new file mode 100644
index 0000000..184fd06
--- /dev/null
+++ b/kubernetes/tasks/install/server/network-plugin/deploy_cilium.yml
@@ -0,0 +1,63 @@
+- name: Check if already installed in cluster
+  command: "cilium status"
+  register: cilium_status
+  ignore_errors: true
+  run_once: true
+
+- name: Get Cilium CLI version
+  ansible.builtin.command:
+    argv:
+      - curl
+      - -s
+      - https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt
+  register: cilium_cli_version
+  check_mode: no
+  changed_when: false
+  run_once: true
+
+- name: Determine CLI architecture
+  set_fact:
+    cli_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"
+    run_once: true
+
+- name: Download and verify Cilium CLI
+  block:
+    - name: Download Cilium CLI tar.gz file
+      get_url:
+        url: "https://github.com/cilium/cilium-cli/releases/download/{{ cilium_cli_version.stdout }}/cilium-linux-{{ cli_arch }}.tar.gz"
+        dest: "/tmp/cilium-linux-{{ cli_arch }}.tar.gz"
+        checksum: "sha256:{{ lookup('url', 'https://github.com/cilium/cilium-cli/releases/download/' + cilium_cli_version.stdout + '/cilium-linux-' + cli_arch + '.tar.gz.sha256sum', wantlist=True)[0].split(' ')[0] }}"
+        mode: '0755'
+
+    - name: Extract Cilium CLI tar.gz to /usr/local/bin
+      unarchive:
+        src: "/tmp/cilium-linux-{{ cli_arch }}.tar.gz"
+        dest: "/usr/local/bin"
+        remote_src: yes
+        #extra_opts: ["--strip-components=1"]
+        mode: 777
+  when: cilium_cli_version.stdout is defined
+  become: yes
+
+- name: Clean up temporary files
+  file:
+    path: "/tmp/cilium-linux-{{ cli_arch }}.tar.gz"
+    state: absent
+
+# Install cilium via cli
+- block:
+  - name: Install cilium
+    command: >
+      cilium install
+      --set
+      imap.mode=kubernetes,
+      ipv6.enabled=true,
+    #ipam.operator.clusterPoolIPv4PodCIDRList={{ kubernetes.ipPool.ipv4.cluster_cidr }},
+    #ipam.operator.clusterPoolIPv6PodCIDRList={{ kubernetes.ipPool.ipv6.cluster_cidr }}
+
+  - name: Wait for cilium
+    command: cilium status --wait
+    changed_when: false
+  run_once: true
+  when:
+  - cilium_status.rc != 0
diff --git a/kubernetes/templates/k3s/agent/config.yaml.jinja2 b/kubernetes/templates/k3s/agent/config.yaml.jinja2
index 3bbc958..bf65d65 100644
--- a/kubernetes/templates/k3s/agent/config.yaml.jinja2
+++ b/kubernetes/templates/k3s/agent/config.yaml.jinja2
@@ -1,3 +1,5 @@
+{% set disabled_components = [] %}
+
 ## Base ##
 node-name: {{ ansible_fqdn }}
 # Join cluster
@@ -21,6 +23,15 @@ node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }}
 node-ip: {{ nodeip_ipv4 }}
 {% endif %}
 
+# Network-plugin
+{% if kubernetes.network.plugin == "flannel" %}
+{% else %}
+{% if kubernetes.network.plugin == "cilium" %}
+  # Cilium requires servicelb to be disabled when replacing kube-proxy
+  {% set _ = disabled_components.append('servicelb') %}
+{% endif %}
+{% endif %}
+
 ## Label
 # Region & DC
 node-label:
@@ -34,4 +45,9 @@ node-label:
   - {{ item }}
 {% endfor %}
 
+# Disabled components
+{% if disabled_components %}
+disable: {{ disabled_components | join(',') }}
+{% endif %}
+
 {{ kubernetes.config_extra | to_yaml }}
diff --git a/kubernetes/templates/k3s/server/config.yaml.jinja2 b/kubernetes/templates/k3s/server/config.yaml.jinja2
index 4ed542b..9cc783e 100644
--- a/kubernetes/templates/k3s/server/config.yaml.jinja2
+++ b/kubernetes/templates/k3s/server/config.yaml.jinja2
@@ -1,3 +1,5 @@
+{% set disabled_components = [] %}
+
 ## Base ##
 node-name: {{ ansible_fqdn }}
 {% if inventory_hostname == groups['kubernetes'][0] %}
@@ -46,11 +48,15 @@ flannel-backend: vxlan
 {% else %}
 disable-network-policy: true
 flannel-backend: none
+{% if kubernetes.network.plugin == "cilium" %}
+  # Cilium requires servicelb to be disabled when replacing kube-proxy
+  {% set _ = disabled_components.append('servicelb') %}
+{% endif %}
 {% endif %}
 
 # Ingress-plugin
 {% if kubernetes.ingress_controller != "traefik-ingress" %}
-disable: traefik
+{% set _ = disabled_components.append('traefik') %}
 {% endif %}
 
 ## Label
@@ -68,6 +74,11 @@ node-label:
 {% endfor %}
 {% endif %}
 
+# Disabled components
+{% if disabled_components %}
+disable: {{ disabled_components | join(',') }}
+{% endif %}
+
 {{ kubernetes.config_extra | to_yaml }}
 
 # Image garbage collection tuning (drop-in KubeletConfiguration)