Skip to content

Cilium's Identity-based Security Model: CCA practice questions

Address-based firewalls struggle in Kubernetes because pod addresses change constantly. The Cilium documentation walks through the problem: to let role=frontend pods reach role=backend pods with IP filters, every node that hosts a backend needs a list of all frontend IPs, and each new or deleted frontend pod forces updates on all of those nodes, sometimes many times per second.

By Ibrahim Yesilay · Published · Updated

Independent community practice, not affiliated with or endorsed by CNCF or The Linux Foundation.

What Cilium's Identity-based Security Model covers in CCA

Address-based firewalls struggle in Kubernetes because pod addresses change constantly. The Cilium documentation walks through the problem: to let role=frontend pods reach role=backend pods with IP filters, every node that hosts a backend needs a list of all frontend IPs, and each new or deleted frontend pod forces updates on all of those nodes, sometimes many times per second. A new pod may even have to wait until every filter is updated, or its first connections are dropped.

Cilium removes addresses from the security decision. Every endpoint gets a security identity derived from its labels, and all endpoints that share the same security-relevant labels share one identity with a cluster-wide numeric identifier. Policies allow traffic between identities. When another frontend replica starts, it only needs to resolve the identity that already exists for its label set; nodes running backends do not change anything. If someone relabels a running pod, Cilium re-derives the identity, so the pod immediately falls under the policies for its new labels.

Labels carry a source prefix. A Kubernetes pod label app=web becomes k8s:app=web on the endpoint, special identities use reserved:, and a selector without a prefix uses any:, which matches the key from every source. Not every label has to count: identity-relevant labels can be limited so that metadata such as timestamps does not create a separate identity per pod.

For peers that are not normal pods, Cilium has reserved identities: host for the local node, world for everything outside the cluster, unmanaged for pods Cilium does not manage, health for the health-check endpoints, init for endpoints whose labels are not known yet, remote-node for other nodes, kube-apiserver for nodes hosting API server backends, and ingress for the Envoy ingress proxy. Policy entities such as world, host and remote-node map to these.

Identities have to be known across nodes. Allocation uses Kubernetes custom resources by default, or a key-value store, and by default each agent creates identities itself. A beta mode lets the operator create them centrally, which avoids duplicate identities when several agents see the same new label set at once. On the wire, the sending node embeds the source identity in packets between nodes, so the receiving node can check policy without looking anything up for the source address.

Key points

  • Pods with identical security-relevant labels share one numeric identity across the whole cluster.
  • Scaling out a Deployment needs no policy or filter changes on other nodes.
  • Kubernetes labels appear with a k8s: prefix; unprefixed selectors use the any: source.
  • identityManagementMode=operator (beta) centralises identity creation to reduce duplicates.

Three sample questions

9 CCA questions on Cilium's Identity-based Security Model, 9 with explanations. How practice works

Question 1

In Cilium, what does the term "identity" refer to?
  1. A.The unique IP address assigned to a pod
  2. B.The security context of a container
  3. C.A numeric identifier derived from pod labels that represents workload security identity
  4. D.The digital certificate used for encryption

Correct answer: C

In Cilium, "identity" refers to a numeric identifier derived from a pod's set of labels. This identity is used for policy enforcement, allowing Cilium to implement security policies based on workload characteristics rather than IP addresses, which can change.

Question 2

Which statement about Cilium's identity-based security is true?
  1. A.It assigns identities based only on the pod's IP address
  2. B.It requires manual identity assignment for each pod
  3. C.It allows policies to remain valid even when pod IP addresses change
  4. D.It can only identify pods within the same namespace

Correct answer: C

Cilium's identity-based security model assigns identities based on pod labels rather than IP addresses. This means security policies remain valid even when pod IP addresses change due to restarts or rescheduling, providing more reliable and consistent security.

Question 3

A Deployment scales from 3 to 10 role=frontend pods spread across new nodes, and a policy already allows role=frontend to reach role=backend. What must happen before a new frontend pod can connect?
  1. A.Every node running backend pods adds the new pod IP to an allow list
  2. B.The policy is re-applied so Cilium recompiles it for the new pod IPs
  3. C.Only resolve its identity, the existing role=frontend one
  4. D.The new pod waits until an administrator approves its identity in the kvstore

Correct answer: C

Cilium separates security from network addressing: identity comes from labels and is shared by pods with the same security-relevant labels. Additional frontend pods only resolve that identity; the docs state that no action is needed on the nodes hosting role=backend pods. Why the other options are wrong. "Every node running backend pods adds the new pod IP to an al...": Updating per-IP filters on every node is the scaling problem of address-based security that the identity model avoids. "The policy is re-applied so Cilium recompiles it for the new...": Policies refer to identities, not pod IPs, so new replicas need no policy change. "The new pod waits until an administrator approves its identi...": Identity resolution is automatic and needs no manual approval.

Sources: CNCF CCA curriculum (CCA_Curriculum.pdf), Cilium docs: Identity-Based Security, Cilium docs: Terminology

Practice this topic

Focus mode keeps every question on Cilium's Identity-based Security Model until you leave it. 10 free guest answers, then a free account; no credit card.

Or open CCA practice across all topics.

Sources

The explanation above was checked against these official documents.

Frequently asked questions

Does a pod keep its identity when it gets a new IP address?

Yes. The identity depends on labels, not on the address, so a rescheduled pod with the same labels resolves the same identity.