Skip to content

eBPF-based Platforms versus IPtables-based Platforms: CCA practice questions

Classic Kubernetes networking leans on iptables. kube-proxy programs iptables chains such as KUBE-SVC for every Service, and many firewalls filter traffic by source IP and port. Cilium replaces much of this with eBPF programs and maps, and the documentation explains why that matters in clusters where pods come and go constantly.

By Ibrahim Yesilay · Published · Updated

Independent community practice, not affiliated with or endorsed by CNCF or The Linux Foundation.

What eBPF-based Platforms versus IPtables-based Platforms covers in CCA

Classic Kubernetes networking leans on iptables. kube-proxy programs iptables chains such as KUBE-SVC for every Service, and many firewalls filter traffic by source IP and port. Cilium replaces much of this with eBPF programs and maps, and the documentation explains why that matters in clusters where pods come and go constantly.

The first problem is identity. Pods get new IP addresses whenever they restart or scale, so address-based rules must be rewritten on every node each time a matching pod appears or disappears. With hundreds of thousands of rules, these updates happen with growing frequency. Ports do not help either, since one port such as TCP 80 carries many different kinds of requests. Cilium gives groups of pods with the same labels a security identity, attaches it to their packets and looks up identity and policy in maps, so a scaling event changes a map entry rather than a list of addresses. It can also filter on HTTP methods and paths when ports are not enough.

The second difference is how Services are implemented. Cilium stores ClusterIP and NodePort entries in BPF load-balancer maps such as cilium_lb4_services_v2, using hash tables for high Service density and low latency. For traffic inside the cluster it translates the Service address once, at the connect() system call, instead of rewriting every packet with NAT; the overview describes this as fully replacing kube-proxy. For traffic entering the cluster, XDP can process packets in the driver before the rest of the stack, and the load balancer supports Maglev consistent hashing and Direct Server Return. On a kube-proxy-free cluster, iptables-save | grep KUBE-SVC returns nothing while the Services keep working.

State management differs too. kube-proxy relies on the Linux conntrack table, sized at 32768 entries per CPU core with a minimum of 131072. Cilium keeps its own connection tracking in BPF maps sized from node memory, with the same minimum. Every BPF map has a fixed capacity, for example 64k Service entries by default or 16k policy entries per endpoint, and resizing the Service map on a running node disrupts connections while it is rebuilt, so sizes should be planned before installation.

eBPF does not erase iptables entirely. If a kernel lacks a capability, Cilium implements that function with legacy iptables, and Cilium can also run alongside kube-proxy when kube-proxy replacement is not used.

Key points

  • iptables rules key on IP addresses that churn; Cilium keys policy on label-derived identities stored in maps.
  • Socket-level load balancing translates the Service address once at connect() instead of NATing every packet.
  • Cilium connection tracking uses BPF maps sized from node memory; kube-proxy sizes conntrack per CPU core.
  • BPF maps have fixed capacities, such as 64k Service LB entries by default.

Three sample questions

10 CCA questions on eBPF-based Platforms versus IPtables-based Platforms, 10 with explanations. How practice works

Question 1

Which advantage does Cilium's eBPF implementation provide over traditional iptables-based solutions?
  1. A.Wider compatibility with older Linux kernels
  2. B.Simpler configuration using familiar syntax
  3. C.Consistent performance regardless of the number of network policies
  4. D.Better integration with cloud provider networking

Correct answer: C

Cilium's eBPF implementation provides consistent performance regardless of the number of network policies, unlike iptables-based solutions where performance degrades as the number of rules increases.

Question 2

How does eBPF provide better performance compared to iptables for network policy enforcement?
  1. A.By optimizing rule ordering automatically
  2. B.By using efficient map lookups instead of sequential rule evaluation
  3. C.By offloading processing to specialized hardware
  4. D.By caching policy decisions in user space

Correct answer: B

eBPF provides better performance compared to iptables for network policy enforcement by using efficient map lookups instead of sequential rule evaluation. While iptables must evaluate rules in sequence (O(n) complexity), eBPF can use hash maps or other optimized data structures for O(1) or O(log n) lookups.

Question 3

According to the Cilium docs, why do iptables-based security approaches struggle in dynamic microservices environments?
  1. A.iptables cannot filter TCP traffic by destination port
  2. B.iptables requires a Linux kernel newer than 5.10
  3. C.They filter on IP addresses that churn constantly
  4. D.iptables only works with overlay networking

Correct answer: C

The introduction explains that iptables filters on IP address and TCP/UDP ports, but IP addresses churn in microservices environments, so load balancing tables and access control lists with hundreds of thousands of rules must be updated with growing frequency. Why the other options are wrong. "iptables cannot filter TCP traffic by destination port": iptables does filter TCP and UDP ports; the problem is scale and churn. "iptables requires a Linux kernel newer than 5.10": iptables is much older than eBPF; kernel versions are not the issue. "iptables only works with overlay networking": iptables works independently of the routing mode.

Sources: CNCF CCA curriculum (CCA_Curriculum.pdf), Cilium docs: Introduction to Cilium & Hubble, Cilium docs: Identity-Based Security

Practice this topic

Focus mode keeps every question on eBPF-based Platforms versus IPtables-based Platforms until you leave it. 10 free guest answers, then a free account; no credit card.

Or open CCA practice across all topics.

Sources

The explanation above was checked against these official documents.

Frequently asked questions

Does Cilium remove all iptables usage?

Not necessarily. With kube-proxy replacement, Services need no iptables rules, but Cilium falls back to iptables for features the kernel cannot provide in eBPF and can also run next to kube-proxy.