Cilium Certified Associate

It is a proctored, multiple-choice and multiple-select exam delivered online. Some items present a short scenario and ask you to choose the correct command, policy behaviour, or configuration. The certifying body publishes the current question count, time limit, and delivery details on its official site, so confirm logistics there before booking.

It is positioned as associate level, so it assumes working Kubernetes knowledge - pods, services, namespaces, labels - but not deep eBPF programming. The difficulty comes from policy semantics and reading CLI and Hubble output, not from memorising API fields. Candidates who have run Cilium hands-on usually find it manageable; those who only read docs often struggle with policy interaction questions.

No. You need a mental model of how eBPF programs attached at network interfaces and sockets implement forwarding, policy enforcement, and load balancing, and why that differs from iptables. You are not expected to write eBPF C code or debug verifier errors. Focus on observable behaviour: endpoint identities, policy verdicts, and datapath modes.

Start with architecture and installation so you understand the agent, operator, and datapath modes. Then move to CNI, IPAM, and routing, because policy questions assume you know how endpoints get addresses and identities. Study network policy next, since it carries the heaviest weight. Finish with observability, service mesh and load balancing, and Cluster Mesh.

Practise the Cilium CLI for status and connectivity tests, kubectl for endpoints and policies, and Hubble for flow inspection. Know how to read cilium endpoint list output, policy verdicts, and dropped-flow reasons. Being able to trace a blocked connection from a Hubble drop back to a specific policy rule is the single most useful troubleshooting skill for this exam.

Candidates forget that Cilium identities, not IP addresses, drive policy, and that selecting an endpoint in one direction does not automatically allow the reverse. Others miss how default-deny interacts with namespaces or how L7 rules require an Envoy proxy path. Read each option for direction, selector scope, and whether the rule is ingress or egress before answering.

Retake rules, waiting periods, and any associated cost are set by the certifying body and can change. Check the official certification page for the current policy rather than assuming a fixed number of attempts. If a retake is allowed, use the score report to identify weak domains and rebuild hands-on labs around those areas before rebooking.

Validity period and exam fee are published by the certifying organisation and are not fixed here. Visit the official site for the current fee, any bundle pricing, and the recertification or renewal requirements. Because Cilium releases features quickly, expect renewal to require confirming knowledge of newer capabilities such as Gateway API support.

Not necessary, but structured practice helps. The most effective approach is a small lab cluster where you install Cilium, enable Hubble, write policies, and deliberately break traffic. Pair that with the official documentation per domain. Courses can supply sequencing, but no third-party course is affiliated with or endorsed by the certifying body.