Querying and Changing Cilium Configuration with the Cilium CLI: CCA practice questions

The Cilium CLI is the cilium binary you run from a workstation; it talks to the cluster through kubeconfig. It is not cilium-dbg, which runs inside an agent pod. Configuration lives in two places that the CLI can reach: the agent configuration that the agents read at startup, and the Helm release that cilium install created.

The config command manages the agent configuration and has three subcommands. cilium config view prints the current values. cilium config set takes exactly two arguments, a key and a value, for example cilium config set debug true. cilium config delete takes a single key and removes it. Both set and delete have a --restart flag, short -r, which defaults to true, so the Cilium pods are restarted and the agents load the change at once. Pass --restart=false to write the value now and restart the agents later.

Many settings are better changed through Helm values, because cilium install and cilium upgrade are wrappers around Helm. Values are given with --set, --set-string, --set-file and -f/--values; the older spellings --helm-set, --helm-set-string, --helm-set-file and --helm-values still work because the CLI normalises them to the shorter names. To see what the CLI used for an existing installation, the README points to helm get values -n kube-system cilium.

Upgrades deserve a review step. cilium upgrade does not rewrite your non-default Helm values to match a new release; by default it resets to the new chart and reuses your existing values. Two flags let you look before acting: --dry-run writes the Kubernetes resources to stdout, so piping it into kubectl diff -f - shows what would change in the live cluster, and --dry-run-helm-values prints only the non-default values that would be used. The same command can move to an older version, so cilium upgrade --version also handles downgrades.

To check what the running agents actually have turned on, cilium features status reports enabled features per node, with --node to pick one node and -o for tab, markdown or json output. cilium status gives the health summary of the agent DaemonSet, operator, Envoy, Relay and Cluster Mesh.