I85PREP
⌘ K
Cilium Certified Associate study materials
Cilium Certified Associate study resources

Cilium Certified Associate: Kubernetes Networking with Cilium (CNI, IPAM, Routing)

Cilium Certified Associate · Work through your exam, one topic at a time.

All guide sections

Kubernetes Networking with Cilium (CNI, IPAM, Routing)

This domain covers how pods obtain addresses and how packets reach pods on other nodes: IPAM mode selection, tunnel versus native routing, and masquerading. Questions usually contrast two modes or ask why a pod-to-pod path fails.

IPAM modes

  • cluster-pool (default): each node receives a CIDR from a cluster-wide pool, sized by clusterPoolIPv4MaskSize, tracked in CiliumNode objects. A smaller mask size means a larger per-node CIDR.
  • kubernetes: Cilium consumes the node's spec.podCIDR from the Node object, leaving allocation to the existing controller-manager allocator.
  • multi-pool: several pools selected per namespace or per pod, useful for putting tenants into distinct CIDRs.
  • Cloud modes (eni, azure): addresses come from the provider's IP space, so pods are first-class citizens of the VPC network.

Routing modes

In tunnel mode (VXLAN default), pod traffic to another node is encapsulated, so the underlay only needs node-to-node IP reachability. In native routing, the pod CIDR must be routable - via BGP from Cilium's control plane or an external router, static routes, or cloud route tables. auto-direct-node-routes installs direct node routes when nodes share an L2 segment, avoiding encapsulation for same-subnet traffic.

Masquerading

Traffic leaving the cluster for non-pod destinations is SNAT'd, either by iptables or, with kube-proxy replacement, entirely in eBPF. Pod-to-pod traffic inside the cluster is never masqueraded, which matters for both policy and log correlation.

Worked example

clusterPoolIPv4PodCIDRList: 10.0.0.0/8 with clusterPoolIPv4MaskSize: 24 gives each node a /24: 256 addresses, minus the gateway Cilium reserves, so roughly 250 pods per node. Across 200 nodes that consumes 200 /24s of the /8 and leaves plenty. Choosing a /16 mask would waste most of each block and can exhaust the pool on large clusters. Verify allocations with kubectl get ciliumnodes and inspect per-node usage in cilium status.

Traps

Overlapping the pod CIDR with the node network or a peered VPC range; selecting native routing where pod IPs are not routable, which blackholes traffic silently rather than erroring; assuming tunnel mode still needs routable pod IPs; treating an IPAM mode change as an in-place operation on a live cluster; and ignoring MTU when the underlay is already tight.