Connecting Cilium Clusters with External Networks: CCA practice questions

Making workloads reachable from outside a Cilium cluster usually combines three pieces: something that assigns addresses to Services, something that tells the network where those addresses live, and the datapath that actually forwards packets.

LB IPAM covers the first piece where no cloud load balancer exists. It assigns IPs to Services of type LoadBalancer from CiliumLoadBalancerIPPool resources. The feature is always present but dormant until the first pool is created. Pools can be limited to certain Services with a serviceSelector, and allowFirstLastIPs set to No keeps network and broadcast addresses out of CIDR blocks.

For announcing addresses, BGP Control Plane peers with external routers, such as the top-of-rack peers in the docs' examples. It is enabled with bgpControlPlane.enabled=true and configured with custom resources. A CiliumBGPClusterConfig selects nodes and defines BGP instances with a localASN and peers. A CiliumBGPPeerConfig holds shared session settings: timers, an authSecretRef for a TCP MD5 password, eBGP multihop, graceful restart and address families. CiliumBGPAdvertisement resources, chosen by a label selector in each family, decide what is announced: PodCIDR, CiliumPodIPPool, Service addresses or interface IPs. Without a matching advertisement nothing is announced. Instances do not listen for incoming sessions unless localPort is set. Because the speaker lives in the agent, graceful restart keeps routes in the peer during agent restarts. Service advertisements respect externalTrafficPolicy: Local by advertising only from nodes with a local endpoint. BGP Control Plane does not program the datapath and must not be used for reachability inside the cluster; troubleshooting uses cilium bgp peers and cilium bgp routes.

Where the network has no BGP, such as an office or campus LAN, L2 announcements (beta) answer ARP or NDP queries for LoadBalancer or external IPs. One elected node per Service replies and load-balances the traffic, and the address moves if that node fails. The feature is selected through CiliumL2AnnouncementPolicy, requires the kube-proxy replacement, and does not work with externalTrafficPolicy: Local.

Pods themselves can also be reached directly. Advertising pod CIDRs over BGP lets routers send traffic to pods without NAT or load balancers, while native routing between nodes relies on the network routing pod CIDRs or on routes installed per node. Outbound traffic is handled separately by masquerading and the egress gateway.