Cilium Certified Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

cilium-agent

Privileged DaemonSet pod on every node that compiles and loads eBPF programs, programs endpoints, enforces policy, and serves the local API used by cilium-dbg.

cilium-operator

Cluster-wide Deployment that handles IPAM CIDR allocation, garbage collection of endpoints and identities, and watches CiliumNode and CiliumIdentity objects.

Security identity

Numeric label-derived identifier assigned to each unique pod label set; Cilium policy and datapath maps are keyed on identities rather than IP addresses.

Hubble relay

Component that aggregates flow events from all cilium-agents over gRPC so a single hubble observe or hubble-ui session can see cluster-wide flows.

CiliumEndpointSlice

CRD that batches many CiliumEndpoint objects into one resource to reduce API server and agent watch load; enabled by default in recent versions.

kube-proxy replacement

Setting kubeProxyReplacement=true makes Cilium implement ClusterIP, NodePort, and LoadBalancer services with eBPF, so kube-proxy must not run.

cluster-pool IPAM

Default IPAM mode where the operator assigns a per-node PodCIDR from a configured pool and the agent allocates individual pod IPs from it.

cilium connectivity test

CLI command that deploys a test namespace and validates pod-to-pod, pod-to-service, DNS, and policy paths end to end on the running cluster.

bpf.masquerade

Helm value enabling eBPF-based SNAT instead of iptables MASQUERADE; requires kube-proxy replacement or BPF NodePort and is incompatible with some iptables setups.

Helm values precedence

Agent configuration resolves as command-line flags first, then the agent ConfigMap data, then compiled defaults; Helm renders the ConfigMap from values.

VXLAN tunnel port

Cilium's default tunnel protocol is VXLAN on UDP port 8472; Geneve uses port 6081 and is selected with tunnelProtocol=geneve.

Native routing

routingMode=native sends pod packets without encapsulation; it requires the pod CIDR to be routable on the underlay or advertised via BGP.

CNI conflist path

Cilium writes /etc/cni/net.d/05-cilium.conflist by default; the kubelet reads it to invoke the Cilium CNI binary during pod sandbox creation.

CiliumNode object

Per-node CRD holding the node's allocated pod CIDR, IPAM pool assignments, and health information used by the operator and agents.

Dual-stack requirement

Both ipv4.enabled and ipv6.enabled must be true with an IPv6 pod CIDR, and the Kubernetes cluster itself must be configured dual-stack.

endpointSelector

Field in CiliumNetworkPolicy that selects which pods the policy applies to, using label expressions evaluated against endpoint identities.

toEntities selector

Policy peer matching built-in entities such as world, cluster, host, kube-apiserver, remote-node, and all, instead of pod labels.

toFQDNs rule

Egress policy peer matching DNS names or patterns; requires DNS interception so Cilium can map resolved IPs to the allowed names.

L7 policy proxy

HTTP, Kafka, and DNS L7 rules redirect matching traffic to the embedded Envoy proxy, which enforces per-request rules before forwarding.

Policy enforcement modes

Per-endpoint modes default, always, never, and disabled control whether policy is ignored, enforced with default-deny, or audited only.

cilium-dbg monitor

Node-local command streaming datapath events with verdicts and drop reasons; flags such as -t drop and -t trace filter the output.

Hubble verdict field

Each flow carries FORWARDED, DROPPED, or ERROR; DROPPED flows include a named drop reason such as Policy denied.

Drop reason diagnosis

Named causes printed by monitor, e.g. Policy denied, CT no matching entry, or Invalid source identity, pointing to policy, conntrack, or identity issues.

Endpoint not-ready state

An endpoint stuck in waiting-for-identity or not-ready usually indicates identity allocation or CNI/agent problems; inspect with cilium-dbg endpoint get.

Tunnel MTU overhead

VXLAN encapsulation adds 50 bytes per packet; the underlay MTU must exceed the pod MTU by at least that amount to avoid fragmentation and drops.

Embedded Envoy proxy

Cilium Service Mesh runs Envoy inside the cilium-agent as a per-node proxy, avoiding a sidecar container in every pod.

CiliumEnvoyConfig

CRD that injects custom Envoy listeners, clusters, and routes into the per-node proxy; used for advanced L7 and Gateway/Ingress behavior.

Maglev load balancing

loadBalancer.algorithm=maglev selects consistent hashing for service backends, reducing disruption when backend sets change; the default is random.

GatewayClass controller name

Cilium's Gateway API implementation uses the controller name io.cilium/gateway-controller in the GatewayClass that a Gateway references.

CiliumLoadBalancerIPPool

CRD defining ranges of IPs the Cilium LB IPAM controller assigns to LoadBalancer services, optionally advertised via BGP peering policies.

clustermesh-apiserver

Per-cluster component exposing the shared identity and endpoint state to remote clusters over port 2379; agents connect on port 4240.

Global service annotation

service.cilium.io/global: "true" makes a Service load-balance across all connected clusters; shared: "false" restricts backends to the local cluster.