Cilium
Hard
Networking
What is the purpose of Cilium's 'prefilter' feature?
Select your answer:
Show answer and explanation
Answer: To filter traffic before it reaches the main Cilium datapath
Explanation
Cilium's 'prefilter' feature filters traffic before it reaches the main Cilium datapath. It allows you to define rules to drop traffic based on IP addresses and ports at an early stage in packet processing, which can improve performance by reducing the load on the main datapath. This is particularly useful for blocking known malicious sources or implementing simple firewall rules.
More hard Cilium questions
- In Cilium's tunnel mode (VXLAN or Geneve), how does the receiving node learn the security identity of a packet sent by a pod on another node?
- A CiliumNetworkPolicy contains HTTP rules, such as allowing only GET requests to /api. Which component enforces those rules?
- How does a client experience a request blocked by an L3/L4 Cilium policy, compared with one blocked by an L7 HTTP rule?
- With Cilium's default policy enforcement mode, when does a pod go from allowing all ingress traffic to denying everything that isn't explicitly allowed?
- In a CiliumNetworkPolicy, what does the entity 'world' match?
- An egress CiliumNetworkPolicy allows toFQDNs with matchName: api.example.com, but connections to that host are still dropped. The policy has no other rules. What is missing?