Cilium
Hard
Policies
A CiliumNetworkPolicy contains HTTP rules, such as allowing only GET requests to /api. Which component enforces those rules?
Select your answer:
Show answer and explanation
Answer: An Envoy proxy that Cilium redirects the matching traffic to
Explanation
eBPF programs enforce L3 and L4 rules in the kernel. When a rule has an L7 section, the datapath redirects that traffic to Envoy, which parses the HTTP or gRPC requests and applies the rule. Envoy runs inside the agent or as a separate cilium-envoy DaemonSet. Only traffic selected by L7 rules goes through the proxy.
More hard Cilium questions
- How does a client experience a request blocked by an L3/L4 Cilium policy, compared with one blocked by an L7 HTTP rule?
- With Cilium's default policy enforcement mode, when does a pod go from allowing all ingress traffic to denying everything that isn't explicitly allowed?
- In a CiliumNetworkPolicy, what does the entity 'world' match?
- An egress CiliumNetworkPolicy allows toFQDNs with matchName: api.example.com, but connections to that host are still dropped. The policy has no other rules. What is missing?
- What does enabling Maglev consistent hashing in Cilium's kube-proxy replacement give you?
- What does Direct Server Return (DSR) mode change in Cilium's NodePort and LoadBalancer handling?