I85PREP
⌘ K
Cilium Certified Associate study materials
Cilium Certified Associate study resources

Cilium Certified Associate: Cilium Installation and Configuration

Cilium Certified Associate · Work through your exam, one topic at a time.

All guide sections

Cilium Installation and Configuration

The Installation and Configuration domain tests the Helm values and host prerequisites that decide whether anything else in the cluster works: kernel features, IPAM mode, routing mode, kube-proxy replacement, and Hubble. Expect questions that hand you a partial configuration and ask what breaks.

Prerequisites that actually break installs

  • Linux kernel 4.19 is the floor; 5.x is expected for the full kube-proxy replacement feature set and the richest drop-reason reporting.
  • A mounted BPF filesystem at /sys/fs/bpf. cgroup v2 is preferred for socket-level acceleration and the bandwidth manager.
  • Exactly one CNI plugin. A leftover /etc/cni/net.d/*.conf from flannel or Calico causes pods to be handled by the wrong plugin or to get no networking at all.
  • With kube-proxy replaced, the agent needs a reachable API server at startup, so k8sServiceHost and k8sServicePort must be set. Otherwise agents crash-loop, because the ClusterIP of kubernetes.default is only programmed by the agent that is not yet ready.

Values that decide the architecture

  • ipam.mode: cluster-pool (default; per-node CIDRs carved from a cluster pool), kubernetes (consume the node's podCIDR), multi-pool, or cloud modes (eni, azure).
  • routingMode: tunnel (VXLAN by default, Geneve via tunnelProtocol) or native, which needs routable pod IPs, typically via BGP.
  • kubeProxyReplacement: true for full replacement; deploy without kube-proxy when you set it.
  • bpf.masquerade=true moves SNAT into eBPF and requires kube-proxy replacement.
  • hubble.relay.enabled and hubble.ui.enabled: the CLI talks to the relay's gRPC endpoint, so a disabled relay makes flow queries fail even though the agent exports flows.

Worked example

You install with kubeProxyReplacement=true but omit k8sServiceHost. Agents start, then fail API discovery because no component programs the API server's ClusterIP. Set k8sServiceHost to the control-plane endpoint or LB VIP, set k8sServicePort to 6443, and roll the DaemonSet. cilium status should then report KubeProxyReplacement: True with the devices used for service translation.

Traps

Assuming tunnel mode requires no MTU thought - VXLAN and Geneve add overhead, and manual MTU overrides are common on clouds; enabling the Hubble UI without the relay; leaving operator.replicas at one in production; and installing on top of an existing CNI.