Cilium Certified Associate case studies
Cilium Certified Associate · Put your knowledge to work in context.
The Cilium Certified Associate (CCA) is an entry-to-intermediate credential for engineers who operate or support Kubernetes clusters where Cilium provides networking, security, and observability. It suits platform engineers, DevOps and SRE staff, cluster administrators, and security engineers who need to reason about eBPF-based dataplanes rather than only write YAML. Expect the exam to test how Cilium is architected (agents, operator, and the eBPF datapath), how it is installed and configured, and how it handles CNI duties, IPAM, and routing between pods, nodes, and external networks. A large share of the content concerns policy: CiliumNetworkPolicy, endpoint identity, and how default-deny and layered rules interact with Kubernetes NetworkPolicy. The Cilium Certified Associate case studies are 5 cases and about 2,709 words.
1Pod IP allocation failures after node scale-out
A 260-node Kubernetes cluster runs Cilium 1.15 with cluster-pool IPAM. The pod CIDR is 10.244.0.0/16 and each node receives a /24, so the cluster has exhausted all 256 available per-node blocks.
633 words, about 3 min2Intermittent DNS failures with toFQDNs egress policy
A payments namespace runs 40 pods. A CiliumNetworkPolicy selects all pods in the namespace with default-deny egress, then allows UDP and TCP 53 to kube-dns and a separate rule with toFQDNs: matchName: api.stripe.com .
576 words, about 3 min3Large TLS transfers stall after enabling jumbo frames
An AWS EKS cluster runs Cilium 1.15 with VXLAN tunneling and kube-proxy replacement. Worker nodes use MTU 9001.
485 words, about 2 min4On-prem clients cannot reach a Gateway API LoadBalancer IP
A platform team runs Cilium 1.16 with kube-proxy replacement, Gateway API, and the BGP control plane. They expose a Gateway prod-gw in namespace prod with listener hostname app.example.com , and an HTTPRoute in prod for app.example.com to service web .
514 words, about 3 min5Cluster Mesh connects but global Service uses only local backends
Two Cilium 1.15 clusters, east and west , are connected with Cluster Mesh. Both were built from the same Terraform module: pod CIDR 10.244.0.0/16, service CIDR 10.96.0.0/16.
501 words, about 3 min