Cilium Certified Associate study plan

Diagram the Cilium datapath from pod veth through the eBPF program at the tc hook to the physical NIC, labeling where tail calls, policy checks, and LB lookups occur

Explain the roles of cilium-agent, cilium-operator, and the Hubble relay and identify which component owns IPAM, endpoint lifecycle, and CRD reconciliation

Trace a packet between two local pods and write out each identity lookup and policy verdict decision point

Provision a single-node kind or minikube cluster and install Cilium with Helm, then confirm agent health with cilium status and cilium-dbg status

Compare Cilium's IPAM modes (cluster-pool, kubernetes host-scope, multi-pool, ENI/Azure) and select the correct mode for a given cloud or on-prem scenario

Install Cilium with kube-proxy replacement enabled and verify that the eBPF-based service load balancer handles ClusterIP traffic

Configure and validate native routing versus tunneling (VXLAN/Geneve) and explain when direct-routing device selection matters

Tune MTU and confirm pod-to-pod throughput across nodes with a simple iperf3 test

Enable and inspect the CiliumEndpoint and CiliumIdentity CRDs to explain how security identities are assigned to pods

Configure a multi-pool or cluster-pool IPAM setup and confirm pods draw addresses from the intended pool

Diagnose a pod stuck in ContainerCreating by reading cilium-dbg endpoint list and the agent log for IPAM or endpoint allocation errors

Explain how the operator garbage-collects stale identities and endpoints and demonstrate it by deleting a workload

Write and apply CiliumNetworkPolicy rules for L3/L4 ingress and egress and verify enforcement with connectivity tests

Use Cilium's L7 policy for HTTP method and path filtering and confirm allowed versus denied requests

Apply DNS-based egress policy and demonstrate that only the named FQDN resolves and connects

Explain identity-based policy selection versus label-selector policy in Kubernetes NetworkPolicy and convert one of each

Enable Hubble and inspect flows with hubble observe filters for verdict, namespace, and identity

Build a Hubble UI or CLI workflow that proves a policy drop and identifies the offending identity

Diagnose a policy that silently blocks traffic by correlating Hubble verdicts with cilium-dbg policy get output

Document a runbook for common policy misconfigurations, including missing DNS rules and identity churn

Collect and interpret metrics from the cilium-agent Prometheus endpoint and identify policy drop and datapath error counters

Run cilium-dbg monitor and cilium-dbg trace to follow a dropped packet end to end

Enable Cilium's built-in connectivity test suite and triage failures by component

Use cilium-dbg bpf CT list and NAT map inspection to explain a service connectivity issue

Configure a Cilium LoadBalancer IP pool and expose a service with a fixed external IP

Deploy the Cilium Gateway API implementation and route traffic to two backend services by hostname and path

Set up Cluster Mesh between two clusters and verify cross-cluster service discovery and failover

Explain how global services and shared identities behave across clusters and test one cross-cluster policy

Re-run a full practice exam under timed conditions and log every missed question by domain

Re-derive the datapath, IPAM, and policy decision points from memory without notes

Rebuild a broken policy and IPAM scenario from scratch in under 30 minutes

Review weak areas with targeted labs and close every gap identified in the practice run