IP Address Management (IPAM): CCA practice questions

IPAM decides where pod addresses come from, and Cilium supports several modes. The choice should be made when the cluster is built: the documentation warns that changing the IPAM mode of a live cluster can cause persistent loss of connectivity, recommends a fresh cluster for a mode change, and names cluster-pool to multi-pool as the only online migration currently available.

Cluster scope is the default. The Cilium operator carves per-node PodCIDRs out of clusterPoolIPv4PodCIDRList and writes them to spec.ipam.podCIDRs of each CiliumNode; the agent waits for that range and then hands out addresses locally. Because Kubernetes is not involved, this works even when the controller manager does not allocate node CIDRs. Two operational rules matter. When the pool runs low, add a new entry to the list instead of editing an existing one, and leave clusterPoolIPv4MaskSize alone, because neither can be changed safely. The default pod range is 10.0.0.0/8, so a node network inside 10.x conflicts with it: traffic meant for other nodes is treated as pod traffic and node connectivity breaks until a non-overlapping pod CIDR is configured.

Kubernetes host scope, ipam.mode=kubernetes, uses the PodCIDR that Kubernetes assigns to each v1.Node. The controller manager must run with --allocate-node-cidrs, otherwise the agents wait at startup for a range that never appears.

Multi-pool, ipam.mode=multi-pool, is the most flexible option and the only one with several CIDRs per node and dynamic allocation that also works with tunnel routing. Pools are CiliumPodIPPool resources with CIDR lists and a fixed mask size. A pod picks a pool through the ipam.cilium.io/ip-pool annotation on itself or its namespace, or through the pool's podSelector and namespaceSelector. Pods that match nothing use the pool named default, unless ipam.cilium.io/require-pool-match is set to true, which blocks allocation until a non-default pool matches. A pod that matches two pools for one address family gets no address, so selectors must not overlap. Annotations are read only when a pod is created. The agent records its needs in spec.ipam.pools.requested of its CiliumNode and the operator answers in spec.ipam.pools.allocated.

Cloud modes hand allocation to the provider. With AWS ENI the operator is the only component that calls the EC2 API, which avoids rate limits, and it keeps a pre-allocation watermark of free addresses on each node so new pods do not wait for API calls. Azure IPAM, GKE and CRD-backed modes take their CIDRs from outside Cilium and support direct routing only. The IPAM feature table lists seven modes: Kubernetes host scope, cluster scope, multi-pool, CRD-backed, AWS ENI, Azure IPAM and GKE.