You install Cilium with kubeProxyReplacement=true on a cluster without kube-proxy. Why do you have to set k8sServiceHost and k8sServicePort?

Select your answer:

A.They set the address and port that Hubble Relay listens on
B.They are only needed when ClusterMesh connects other clusters
C.They tell the agents which node runs the Cilium operator
D.Without kube-proxy, the agent can't reach the API server via its ClusterIP

Show answer and explanation

Answer: Without kube-proxy, the agent can't reach the API server via its ClusterIP

Explanation

Pods normally reach the API server through the kubernetes Service ClusterIP, which kube-proxy translates. Without kube-proxy, Cilium does that translation itself, but the agent has to talk to the API server before its datapath is ready. Pointing it at the real API server address or load balancer solves this bootstrap problem.

Take the Expert Cilium quiz All Cilium levels

In Cilium's default cluster-pool IPAM mode, what assigns each node its pod CIDR?
What is the purpose of Cilium's egress gateway feature?
What is the purpose of Cilium's 'prefilter' feature?
In Cilium's tunnel mode (VXLAN or Geneve), how does the receiving node learn the security identity of a packet sent by a pod on another node?
A CiliumNetworkPolicy contains HTTP rules, such as allowing only GET requests to /api. Which component enforces those rules?
How does a client experience a request blocked by an L3/L4 Cilium policy, compared with one blocked by an L7 HTTP rule?

You install Cilium with kubeProxyReplacement=true on a cluster without kube-proxy. Why do you have to set k8sServiceHost and k8sServicePort?

Select your answer:

Explanation

More hard Cilium questions