Cilium
Hard
Architecture
In Cilium's tunnel mode (VXLAN or Geneve), how does the receiving node learn the security identity of a packet sent by a pod on another node?
Select your answer:
Show answer and explanation
Answer: The sending node puts the source identity in the encapsulation header
Explanation
Encapsulation protocols can carry metadata with each packet. Cilium uses this to send the source security identity, in the VXLAN VNI or the Geneve header, so the destination node can enforce policy without a lookup. In native routing mode there's no tunnel header, so Cilium maps the source IP to an identity through its ipcache instead.
More hard Cilium questions
- A CiliumNetworkPolicy contains HTTP rules, such as allowing only GET requests to /api. Which component enforces those rules?
- How does a client experience a request blocked by an L3/L4 Cilium policy, compared with one blocked by an L7 HTTP rule?
- With Cilium's default policy enforcement mode, when does a pod go from allowing all ingress traffic to denying everything that isn't explicitly allowed?
- In a CiliumNetworkPolicy, what does the entity 'world' match?
- An egress CiliumNetworkPolicy allows toFQDNs with matchName: api.example.com, but connections to that host are still dropped. The policy has no other rules. What is missing?
- What does enabling Maglev consistent hashing in Cilium's kube-proxy replacement give you?