Skip to content

Understand the Role of eBPF in Cilium: CCA practice questions

Cilium is built on eBPF: small programs that the Linux kernel runs at defined hook points. The agent loads these programs on each node and keeps their state in BPF maps, so networking, load balancing and policy happen inside the kernel without changing applications or container configuration.

By Ibrahim Yesilay · Published · Updated

Independent community practice, not affiliated with or endorsed by CNCF or The Linux Foundation.

What Understand the Role of eBPF in Cilium covers in CCA

Cilium is built on eBPF: small programs that the Linux kernel runs at defined hook points. The agent loads these programs on each node and keeps their state in BPF maps, so networking, load balancing and policy happen inside the kernel without changing applications or container configuration.

The datapath uses four kinds of hooks. XDP runs in the network driver at the earliest possible point after a packet arrives and suits filtering and DDoS protection. The tc ingress and egress hooks run after initial stack processing but before the L3 layer, with access to most packet metadata, which makes them the place for endpoint policy and redirects. Cilium attaches a tc program to the host side of every pod veth pair, so all traffic leaving a container passes through it. The socket operations hook, attached to the root cgroup, watches TCP connections reach the ESTABLISHED state, and the socket send/recv hook can then pass messages straight to a local peer socket.

From these hooks Cilium assembles named datapath objects. Prefilter is an XDP program with CIDR maps that drops traffic that cannot be valid, for example when the destination is not a valid endpoint. Endpoint Policy maps each packet to a security identity, enforces L3 and L4 rules and decides whether to deliver, load-balance or send the packet to the proxy. Service looks up destination address and port in a map and picks a backend. L3 Encryption hands packets to the kernel xfrm layer for IPsec. Socket Layer Enforcement accelerates node-local TCP. L7 Policy redirects traffic to a userspace proxy instance, Envoy, which forwards it or returns a reject message according to the L7 rules.

The virtual devices cilium_host and cilium_net, and cilium_vxlan in overlay mode, connect these objects with the routing stack. When the kernel lacks a feature a function needs, Cilium falls back to a legacy iptables implementation for that function.

Running the datapath has requirements. Installing programs system-wide needs CAP_SYS_ADMIN, which the standard DaemonSet grants automatically; the docs name running the agent as root or as a privileged container as the quickest way. The BPF filesystem at /sys/fs/bpf lets programs and maps outlive an agent restart, so forwarding continues while the agent restarts or is upgraded; Cilium mounts it automatically if the host has not.

Key points

  • XDP is the earliest hook; tc hooks on the host-side veth carry endpoint policy.
  • Endpoint Policy is the datapath object that maps packets to identities and enforces L3/L4 rules.
  • L7 rules are enforced by userspace proxies such as Envoy, not by the eBPF programs.
  • bpffs at /sys/fs/bpf keeps eBPF state across agent restarts and upgrades.

Three sample questions

9 CCA questions on Understand the Role of eBPF in Cilium, 9 with explanations. How practice works

Question 1

When using the Cilium eBPF native datapath, at which point in the kernel are packets processed?
  1. A.Only after they reach user space
  2. B.Only before they enter the network stack
  3. C.Directly in the kernel at various hook points
  4. D.In a separate network namespace

Correct answer: C

Cilium's eBPF native datapath processes packets directly in the Linux kernel at various hook points, such as XDP (eXpress Data Path), TC (Traffic Control), and socket operations, without requiring transitions to user space.

Question 2

Which eBPF hook point provides the earliest possible packet interception in the network stack?
  1. A.TC (Traffic Control)
  2. B.XDP (eXpress Data Path)
  3. C.Socket
  4. D.cgroup

Correct answer: B

XDP (eXpress Data Path) provides the earliest possible packet interception in the network stack, allowing packets to be processed before they even enter the kernel's networking stack.

Question 3

How does Cilium use eBPF maps in its implementation?
  1. A.Only for storing network policy rules
  2. B.Only for tracking active connections
  3. C.For efficiently storing and retrieving data needed by eBPF programs
  4. D.Only for maintaining identity information

Correct answer: C

Cilium uses eBPF maps for efficiently storing and retrieving various types of data needed by eBPF programs, including policy information, connection state, routing information, and identity mappings. Maps are a fundamental data structure in eBPF that enable stateful programs.

Practice this topic

Focus mode keeps every question on Understand the Role of eBPF in Cilium until you leave it. 10 free guest answers, then a free account; no credit card.

Or open CCA practice across all topics.

Sources

The explanation above was checked against these official documents.

Frequently asked questions

Does traffic stop when cilium-agent restarts?

No. The loaded programs and their maps stay in the kernel, pinned in the BPF filesystem, so forwarding continues while the agent restarts or is upgraded.