I85PREP
⌘ K
Cilium Certified Associate study materials
Cilium Certified Associate study resources

Cilium Certified Associate: Network Policy and Security

Cilium Certified Associate · Work through your exam, one topic at a time.

All guide sections

Network Policy and Security

Network Policy and Security is the highest-yield domain. It tests the identity model applied to enforcement: per-direction default deny, endpoint selectors, entities, L7 rules, and the host firewall.

The rule that surprises people

Enforcement is per endpoint and per direction. The moment any policy selects an endpoint for ingress, all ingress to it is denied except what policies allow. Egress is independent: an endpoint covered only by ingress policy still has unrestricted egress. Kubernetes NetworkPolicy, CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy are additive; the L3/L4 model has no explicit deny rule.

Selectors and entities

  • endpointSelector chooses the endpoints the policy applies to; fromEndpoints/toEndpoints choose the peers.
  • A cluster-wide policy omits namespaces, so it can reach any namespace.
  • toEntities covers non-pod peers: world (outside the cluster), cluster, host, remote-node, kube-apiserver, health, init. Kubelet probes and node health checks need host allowed.
  • toFQDNs requires the DNS proxy: the policy must also permit DNS to kube-dns with a matchPattern, or resolution never happens and the name rule can never match.
  • toPorts.rules enables L7 parsing for HTTP, Kafka, DNS or gRPC, which redirects the flow through per-node Envoy.

Worked example

Allow app=client to reach api.example.com on 443 and nothing else. One policy needs two egress rules: (1) toEndpoints k8s-app=kube-dns in kube-system, ports 53 UDP and TCP, with a DNS matchPattern; (2) toFQDNs matchName: api.example.com, port 443. The proxy resolves the name, caches the answers, and admits those IPs on 443. Omit rule (1) and the pod resolves nothing - the symptom looks like broken DNS, not policy.

Traps

Securing only one direction and expecting the other to follow; assuming world includes cluster pods; using CIDR rules for workloads that reschedule; forgetting the host firewall is off until hostFirewall.enabled=true, and that once a node-selecting cluster-wide policy exists it defaults to deny; and expecting L7 rules to work without the proxy path.