Linux Foundation Cilium-Associate - Cilium Certified AssociateCCA

Technical explanation

The status output shows Envoy DaemonSet: disabled (using embedded mode) . In embedded mode, Cilium starts Envoy as a separate process inside the Cilium agent pod when a feature requiring Layer 7 processing—such as an L7 network policy, protocol visibility, Ingress, or Gateway API—is used. This is precisely the behavior described in option B.

The remaining choices contradict the exhibit. The Cilium DaemonSet has a desired count of three, which ordinarily indicates three schedulable nodes running Cilium, not four. Hubble Relay: OK means the aggregation component is healthy. Hubble Relay connects to the Hubble instances associated with Cilium agents and presents a multi-node API to clients such as Hubble CLI and Hubble UI. Finally, ClusterMesh: disabled rules out the claim that the installation is currently configured for Cilium Cluster Mesh service discovery and cross-cluster load balancing.

Cilium can alternatively run Envoy through the independently life-cycled cilium-envoy DaemonSet. That is not the deployment displayed here because the DaemonSet is explicitly disabled and embedded mode is reported.

Official references

Envoy deployment modes ; Hubble internals .

Study Guide topic: Architecture.

Technical explanation

Kubernetes host-scope IPAM can be used with both Cilium tunnel routing and native direct routing. The IPAM mechanism determines how each node receives and locally allocates pod addresses; it does not inherently require a particular packet-forwarding model. The current IPAM feature matrix explicitly marks both tunnel routing and direct routing as supported for Kubernetes host-scope mode.

In this mode, Kubernetes allocates a PodCIDR to each node and publishes it through the standard v1.Node resource, normally in spec.podCIDR or spec.podCIDRs . The Cilium agent waits for the relevant range and allocates individual pod addresses from that node-specific CIDR. The correct configuration is ipam: kubernetes or the Helm equivalent ipam.mode=kubernetes , not ipam: crd ; therefore, C is false.

The documented feature matrix does not provide multiple CIDRs per cluster or multiple CIDRs per node for this mode, eliminating A and B. Multi-pool IPAM is the Cilium mode designed for allocating per-node CIDRs from multiple configurable pools.

Because Kubernetes host-scope IPAM supports either overlay tunneling or direct routing while the other statements contradict its capabilities or configuration, D is correct.

Official references

IP Address Management ; Kubernetes Host Scope .

Study Guide topic: Installation and Configuration.

Technical explanation

Ingress provides a comparatively simple API for exposing HTTP and HTTPS applications through host- and path-based routing. Gateway API is a broader, extensible family of resources that separates infrastructure configuration from application routing. Resources such as GatewayClass , Gateway , HTTPRoute , GRPCRoute , TLSRoute , TCPRoute , and UDPRoute model listeners, routes, protocols, ownership, and attachment relationships explicitly.

Gateway API was designed around operational roles. An infrastructure provider can manage the GatewayClass , a cluster operator can provision a Gateway , and an application team can own a route attached to that Gateway. This offers clearer delegation than the single Ingress resource and supports protocols and traffic-management functions beyond the original Ingress model.

The two APIs are not simply different names for identical functionality, so A is false. Option C is also inaccurate because Cilium’s implementations of both Ingress and Gateway API integrate with its eBPF datapath and Envoy; Ingress is not inherently an iptables-only implementation. Option D incorrectly limits Gateway API to internal routing. It can expose internet-facing applications through generated LoadBalancer or NodePort Services or through host-network listeners.

Official references

Migrating from Ingress to Gateway ; Gateway API Support .

Study Guide topic: Service Mesh.

Technical explanation

Masquerading performs source network address translation for qualifying traffic that leaves the cluster. Because pod addresses are often private and not routable by the external network, Cilium replaces the pod’s source address with an address belonging to the egress node. Return traffic can then reach that node, which reverses the translation and delivers the response to the originating pod. B correctly summarizes this behavior.

Masquerading is a form of SNAT, not DNAT. DNAT modifies the destination address, commonly to direct incoming traffic toward another endpoint, so C is incorrect.

Cilium documents its eBPF-based masquerading implementation as the more efficient implementation. The iptables version is the legacy alternative, making A false. Conversely, eBPF masquerading depends on appropriate kernel eBPF capabilities and Cilium’s BPF NodePort functionality. It cannot be assumed to work on every kernel version, so D is false. The legacy iptables implementation is the mode documented as broadly working across kernel versions.

Cilium can exclude natively routable CIDRs from masquerading, and administrators may configure separate IPv4 and IPv6 masquerading behavior.

Official references

Cilium Masquerading , Cilium System Requirements

Study Guide topic: SNAT, native-routing exclusions, and eBPF versus iptables masquerading.

Technical explanation

Option B correctly represents the Ingress as a Gateway and an attached HTTPRoute . The Gateway is named cilium , uses gatewayClassName: cilium , and exposes an HTTP listener on port 80. The HTTPRoute uses parentRefs with the same Gateway name, cilium , so the route attaches to the declared listener. Its two rules preserve the original routing behavior: /details with PathPrefix targets the details Service on port 9080, while / with PathPrefix targets productpage on port 9080.

Option A declares a Gateway named cilium but attaches its route to nginx-gateway . Because the parent reference does not identify the displayed Gateway, it is not equivalent. Options C and D use kind: Route ; the correct resource kind for HTTP path routing is HTTPRoute . They also contain malformed or altered backend and matching fields. Option D changes the details backend name, while option C contains incorrect route structure and path content.

Cilium’s official migration example uses the same conversion pattern: the Ingress class becomes the Gateway’s class, paths move into HTTPRoute.rules , and the route identifies its Gateway through parentRefs .

The supplied key incorrectly identifies A. The verified answer is B.

Official references

HTTP Migration Example .

Study Guide topic: Service Mesh.

Technical explanation

In cluster-scope IPAM, the Cilium Operator allocates a PodCIDR to each node from the configured cluster-wide address pool. It records those allocations in each node’s CiliumNode custom resource, specifically under spec.ipam.podCIDRs . The Cilium agent waits for this allocation during startup and then performs host-local allocation of individual pod addresses from the CIDR assigned to its node.

This division of responsibility explains why C is correct. The agent consumes its assigned range and allocates endpoint addresses locally, but it does not independently choose the cluster-wide per-node PodCIDR. The Operator coordinates those ranges to prevent nodes from receiving overlapping allocations.

Options A and D describe Kubernetes host-scope IPAM rather than Cilium cluster-scope IPAM. In Kubernetes host-scope mode, the Kubernetes controller manager assigns PodCIDRs and exposes them through spec.podCIDR or spec.podCIDRs in the standard Kubernetes Node resource. Cluster-scope mode is specifically useful when Kubernetes is not configured to perform that allocation or when Cilium should control the cluster address pool.

Therefore, the managing component and resource are the Cilium Operator and CiliumNode , respectively.

Official references

Cluster-Pool IPAM ; Cluster Scope IPAM .

Study Guide topic: Installation and Configuration.

Technical explanation

For every pod managed by Cilium, the responsible node-local Cilium agent creates a CiliumEndpoint object with the same name and namespace. The object exposes endpoint state such as labels, the allocated security identity, addressing information, and effective policy. The agents also create endpoint objects for their inter-agent health endpoints. B is therefore correct.

The other responsibilities belong primarily to the Cilium Operator. The operator normally registers Cilium’s CustomResourceDefinitions, manages addresses for LoadBalancer Services when LB IPAM is active, and performs configured cluster-wide synchronization or shared-state operations. It also garbage-collects orphaned CiliumEndpoint resources when their associated pods no longer exist or have permanently completed.

The Cilium agent itself runs on each node. It responds to workload lifecycle events, creates and manages local endpoints, loads eBPF programs, applies policies, and maintains the node’s datapath. This division ensures that latency-sensitive forwarding and endpoint operations remain node-local while logically cluster-wide activities are consolidated in the operator.

Official references

CiliumEndpoint CRD , Cilium Operator Responsibilities

Study Guide topic: Cilium agent, Cilium Operator, and CiliumEndpoint lifecycle.

Technical explanation

Hubble UI and Hubble CLI are Cilium’s integrated interfaces for examining workload network flows. Hubble records source and destination identities, namespaces, workloads, addresses, ports, forwarding verdicts, and drop reasons. When Layer 7 visibility is configured, its flow output can also contain application-level information such as HTTP methods, URLs, response codes, latency, and DNS queries. Filters can narrow the results by source workload, namespace, destination, protocol, port, or verdict, making Hubble appropriate for investigating egress behavior.

Hubble CLI provides detailed event-oriented inspection, while Hubble UI presents flows and service dependencies graphically. Hubble Relay aggregates the per-node Hubble APIs so these clients can obtain cluster-wide visibility.

Load balancing directs traffic but is not an observability interface. Kubernetes NetworkPolicy expresses permitted communications but does not by itself display application-level flow records. Fluentd and Grafana are external logging and visualization components and would violate the requirement to avoid additional tooling.

Layer 7 information requires supported traffic to be redirected through Cilium’s L7 proxy. Hubble then exposes the resulting application-layer flow events through the built-in CLI or UI, making D the complete answer.

Official references

Network Observability with Hubble ; Inspecting Network Flows .

Study Guide topic: Network Observability.