Cilium — eBPF Networking
The eBPF-powered CNI that rethinks Kubernetes networking, security and observability. Learn eBPF fundamentals, Cilium’s identity model, L7 and DNS-aware network policies, Hubble flow visibility, and the datapath that replaces kube-proxy — remembered with spaced repetition.
- flashcards
- 60
- flashcards
- per day
- ~10 min
- per day
- level
- Intermediate
- level
- modules
- 5
- modules
What is Cilium?
Cilium is a CNCF-graduated CNI that provides pod networking, network security, and observability for Kubernetes — built on eBPF, the technology that runs sandboxed programs inside the Linux kernel without patching it or loading modules. That foundation lets Cilium replace slow, IP-based mechanisms like iptables with fast, programmable in-kernel datapaths.
The defining idea is identity-based security: instead of writing rules against pod IPs that churn constantly, Cilium derives a stable identity from workload labels and enforces policy against that. On top of L3/L4 it adds Layer 7 and DNS/FQDN-aware policies, and Hubble gives flow-level observability straight from the datapath — no sidecars.
This track covers eBPF fundamentals, Cilium’s agent/operator architecture and identity model, CiliumNetworkPolicy, Hubble, and the datapath features — kube-proxy replacement, WireGuard encryption, Gateway API and BGP. It uses spaced repetition so the concepts stick.
5 modules, seed to bloom
Each module is a set of flashcards — 60 in total. Answer, review, and watch your knowledge grow from seed to full bloom.
eBPF Fundamentals
What eBPF is, where programs run, the verifier, maps, hooks like XDP and tc, and why it beats iptables
12 cardsCilium Architecture
The agent, operator, CNI plugin, identity model, endpoints, IPAM, datapath modes and ClusterMesh
12 cardsNetwork Policies
CiliumNetworkPolicy vs K8s NetworkPolicy — identity-based, L7-aware, DNS/FQDN, entities and default-deny
12 cardsHubble Observability
Flow visibility, the service map, Hubble Relay, CLI, metrics and policy verdicts — powered by eBPF
12 cardsDatapath & Load Balancing
kube-proxy replacement, Maglev, DSR, WireGuard/IPsec, Gateway API, BGP, egress gateway and bandwidth
12 cardsSample questions
A taste of the real flashcards. Pick an answer, then reveal the explanation.
What is eBPF?
- AA technology to run sandboxed programs in the Linux kernel — without changing kernel source or loading modules
- BA userspace networking library — bypassing the kernel to process packets entirely in application memory
- CA kernel module framework — where custom C modules are compiled against and linked into the running kernel
- DA container runtime interface — letting the kubelet start and stop pods through a standard kernel API
Why does Cilium enforce policy by identity rather than by IP address?
- APod IPs churn as pods reschedule — a label-based identity stays stable and scales far better
- BIP addresses are not visible in eBPF — the datapath can only read labels, never packet headers
- CIdentities are required by Kubernetes — the NetworkPolicy API forbids matching on IP ranges
- DIP-based rules cannot be encrypted — only identity-based rules can travel over WireGuard tunnels
What does a DNS-aware (FQDN) policy in Cilium allow?
- AEgress to destinations by domain name — e.g. allow traffic to api.example.com rather than a raw IP
- BIngress filtered by client hostname — matching the reverse-DNS name of whoever is connecting in
- CBlocking the cluster's internal DNS — preventing pods from resolving any Service names at all
- DRewriting DNS responses — changing the IP that a resolved name points to before the pod sees it
How does Cilium replace kube-proxy?
- AIt implements Service load-balancing in eBPF — replacing kube-proxy's iptables or IPVS rules entirely
- BIt runs kube-proxy in a sidecar — wrapping the existing component rather than replacing its logic
- CIt moves kube-proxy to the control plane — centralizing the same iptables rules onto the masters
- DIt disables Services altogether — requiring workloads to address pods directly by their IP addresses
Learn it once, keep it for good
Answer a question
Each card is one practical concept with multiple options. Pick what you think is right.
Get the full answer
See the correct option plus a clear explanation, and a link to deeper docs when one is available.
Review at the right time
A spaced-repetition engine (SM-2 or FSRS) resurfaces each card just before you would forget it.
Why Cilium is worth your time
The modern Kubernetes datapath
eBPF-based networking is where the ecosystem is heading. Cilium is the reference implementation, and increasingly the default CNI.
Identity-based security that scales
Label-derived identities replace brittle IP rules — the model that makes zero-trust networking practical at cluster scale.
See your network without sidecars
Hubble surfaces every flow and policy verdict from the datapath, so you can actually debug what your cluster’s network is doing.
Understand eBPF, a career skill
eBPF now underpins networking, observability and security tooling across the industry — learning it through Cilium pays off broadly.
Common questions
Do I need to know eBPF first? +
No. The track starts with eBPF fundamentals — what it is, the verifier, maps, and hooks like XDP — before building up to how Cilium uses it, so you can start from scratch.
Is this a Kubernetes networking course? +
It focuses on Cilium specifically — its eBPF datapath, identity model, policies, Hubble and load balancing. A basic grasp of Kubernetes pods and Services helps, but the deck explains Cilium on its own terms.
How long does it take? +
About 10 minutes a day. Spaced repetition means short, frequent sessions beat long cramming, so the concepts stick.
Is it free? +
Yes, completely free. No registration or credit card is required, and all your progress is stored locally in your browser.
Ready to master Cilium?
Plant your first seed today. Ten minutes a day is all it takes to understand eBPF-powered Kubernetes networking.