Explain the architecture
Describe Cilium’s role in Kubernetes, its components, IPAM and datapath models.
Partners and press
Overview
Cilium trades iptables for eBPF. This exam tests what that changes.
An Associate exam on Cilium, the Kubernetes networking project, recommending Kubernetes and basic networking knowledge. Architecture weighs most at 20%, then network policy at 18% and service mesh at 16%, with the other five topics at 10% or less. It takes 90 minutes online with a proctor, in a multiple-choice format, and the credential is valid for two years.
10Modules
90Minutes
2Years valid
7Roles
What it tests
Learn all the way down.
Learn all the way down.
Perform when it matters.
Read and write policy
Interpret Cilium network policies and its identity-based security model, and compare them with Kubernetes network policy.
Mesh and connect
Route with Ingress or the Gateway API, encrypt traffic, compare sidecar and sidecarless designs, and link clusters with Cluster Mesh.
Observe and extend
Use Hubble for Layer 7 visibility, install with the Cilium CLI, and connect to external networks with BGP.
Course outline
Cilium from the eBPF datapath
Cilium from the eBPF datapath
to Cluster Mesh and BGP.
We design this course ourselves. Linux Foundation runs the exam and issues the credential, and LUNARTECH is independent of Linux Foundation.
Cilium runs its logic inside the Linux kernel through eBPF. You learn what eBPF programs are, where they attach, how this differs from iptables-based networking, and what it demands of the kernel.
- What eBPF is and how programs load into the kernel
- Hooks for networking: XDP and traffic control
- Maps and how eBPF programs share state
- iptables-based and eBPF-based datapaths compared
- Benefits: speed, visibility and flexibility
- Kernel requirements and limits
You build A comparison of packet handling for one service under an iptables datapath and an eBPF datapath.
Cilium is a small set of cooperating components. You learn what the agent, operator, CNI plugin, Hubble and its Envoy proxy each do, and how identities rather than addresses drive decisions.
- The Cilium agent on each node
- The operator and cluster-wide tasks
- The CNI plugin and pod setup
- Security identities and labels
- Envoy and Hubble components
- Where state is stored
You build An annotated diagram of a running Cilium installation, mapped to its pods and daemonsets.
The Cilium CLI installs, checks and configures a cluster. You install Cilium, run its connectivity tests, read its status, and view or change configuration safely.
- Preparing a cluster for Cilium
- Installing with the Cilium CLI
- Helm as an alternative
- Checking status with cilium status
- Running connectivity tests
- Viewing and changing configuration
You build A cluster with Cilium installed from the CLI, a passing connectivity test and a configuration change applied.
How pods get addresses and how packets travel between nodes shape everything else. You compare IPAM modes, overlay and native routing, and learn what each means for the network around the cluster.
- IPAM modes: cluster pool, host scope and cloud provider
- Overlay networking with VXLAN or Geneve
- Native routing and what the network must provide
- Choosing a datapath model
- kube-proxy replacement in outline
- Checking addresses and routes on a node
You build Two clusters, one with an overlay and one with native routing, with notes on addresses, routes and packet paths.
Cilium decides by workload identity, not by IP address. You write policies that select by label, extend them to layer 7 and DNS names, compare them with Kubernetes network policy, and set the enforcement mode.
- Identities and label-based selection
- CiliumNetworkPolicy compared with Kubernetes NetworkPolicy
- Cluster-wide policies
- Layer 7 rules for HTTP
- DNS-based egress rules
- Enforcement modes: default, always and never
You build A set of Cilium policies for a sample application, including a layer 7 rule and a DNS-based egress rule.
Hubble shows what the datapath sees. You enable it, watch flows from the command line and the UI, turn on layer 7 visibility, and use flow data to explain a policy decision.
- What Hubble records and where it runs
- Enabling Hubble and its relay
- hubble observe: filtering flows
- The Hubble UI and service map
- Layer 7 visibility for HTTP and DNS
- Reading dropped flows to debug policy
You build A Hubble setup that finds the policy rule blocking a failing connection.
Cilium offers routing and encryption without a proxy in every pod. You route with Ingress and the Gateway API, encrypt traffic in transit, and compare sidecar and sidecarless designs.
- Sidecarless service mesh: the idea
- Ingress and Gateway API support
- Per-node Envoy for layer 7 handling
- Transparent encryption with WireGuard or IPsec
- Mutual authentication in outline
- Sidecar and sidecarless designs compared
You build An application exposed through a Cilium Gateway with encrypted node-to-node traffic.
Applications often span clusters. You connect clusters with Cluster Mesh, share services across them, and see how discovery and load balancing work between sites.
- Why multi-cluster networking
- Requirements: addressing, identities and connectivity
- Enabling Cluster Mesh and connecting clusters
- Global services and cross-cluster discovery
- Load balancing and failover between clusters
- Policy across a mesh of clusters
You build Two clusters joined by Cluster Mesh, serving one global service with failover tested.
Clusters must talk to the world outside them. You advertise pod and service addresses with BGP, control egress with gateways and stable addresses, and connect to existing networks.
- Egress requirements and options
- The BGP control plane in outline
- Advertising pod CIDRs and service addresses
- Load balancer addresses without a cloud
- Egress gateways and fixed source addresses
- Verifying routes with a peer
You build A cluster peering with a router over BGP, advertising its addresses and sending egress from a fixed source.
Design the network for a cluster from the ground up with Cilium. You choose the datapath and addressing, apply policy, turn on observability and encryption, and connect it to a second cluster and the outside.
- Choosing IPAM and datapath for the requirements
- Installing and verifying with the CLI
- Applying identity-based policy
- Observing with Hubble
- Connecting clusters and external networks
- Documenting and handing over the design
You build A documented Cilium network design for two clusters, built, tested and observable.
Issued by
Certifying body · Independent of LUNARTECH
Linux Foundation
The Linux Foundation is a nonprofit that hosts open source projects, including Linux and Kubernetes. It runs the certification program itself, with online, proctored exams. Every certification in this list is valid for two years. LUNARTECH is independent of the Linux Foundation.
How you get there
Top-tier roles go to people who can do the work.
Top-tier roles go to people who can do the work.
Here’s how you get there.
Know where you start.
The Linux Foundation lists no prerequisites but recommends Kubernetes knowledge and basic networking, including the seven-layer model, TCP, UDP, DNS and HTTP.
Work through the course.
Ten modules, designed by LUNARTECH, at your own pace.
Sit it with Linux Foundation.
Linux Foundation runs the exam and issues the credential, so you register and book directly with them.
Support
Support at every stage.
Support at every stage.
You won’t be working through this alone.
Before you start
Try it first.
A 3-day free trial opens a selection of the content. Your card is only charged once it ends.
While you learn
Mentors within reach.
Stuck on a concept? Reach out to a mentor whenever you need help.
While you learn
One-on-one sessions.
On the yearly plan, one-on-one sessions give you dedicated support.
Any time
A team behind you.
Write to info@lunartech.ai at any point, from your trial onwards. If your employer is funding you, we’ll set it up with them directly.
All the way through
A schedule that fits around your life.
Your own paceFrom anywhereAt any hour
After the last lesson
Stay in the network.
Your alumni network stays with you: ongoing support, opportunities and industry insight.
Career support
Career support, past the last lesson. Coaching, a sharper resume, real interview preparation and the people to know.
Career direction
Tailored coaching helps you decide where to aim and how to get there.
Strong portfolio
Hands-on projects become work you can show, not just claim.
Resume and profile
Personalized refinement, so what you send says what you can actually do.
Interview preparation
Preparation for the questions that decide it, so you walk in ready.
Network and search
Connections with industry leaders, and an alumni network that stays with you.
Reviews
Real stories from the community.
LUNARTECH Academy has been the most empowering learning experience of my life, giving me a clear, structured path from the absolute basics to building real-world AI systems with confidence.
Your page is fantastic. As a bachelor’s student in Data Science now accepted for a master’s at UConn, your work has been a real source of motivation.
The programme’s clear, bite-sized content and practical projects dramatically improved my speed from fuzzy idea to MVP and my ability to communicate AI value. I followed the system, and it works.
I really appreciate your teaching style and the way you break down complex topics. It has been incredibly helpful.
After years working mainly with R for econometrics, I found your Python machine learning course a refreshing and engaging way to learn Python.
As a Data Science graduate, I want to thank you for the effort you put into making videos to support growing data scientists.
I’ve been following your work since taking your machine learning course, and I’m impressed by your practical approach to applying AI.
Why choose us
Built around how you actually learn.
One standard behind every course, from the first lesson to long after the last.
Hands-on practice
Apply every idea to real problems, so it becomes something you have used, not only seen.
Industry-aligned curriculum
We keep courses current with the tools, techniques and skills the field asks for.
Flexible learning
Study at your own pace, from anywhere, at any hour.
Certificate of completion
Finish the course and earn a certificate that shows what you have learned.
Focus on your success
Personalized learning plans and support structures carry you through the hard parts.
Lifetime alumni network
Stay connected after you finish, with ongoing support, opportunities and industry insight.
Your certificate
It doesn’t raise its voice. Neither will you.
Finish a LUNARTECH course and its certificate is issued in your name, under our signature. Linux Foundation’s credential comes from Linux Foundation, when you pass its exam.
Certificate of completion
Your Name
CCA course
LUNARTECH RISE Academy
Pricing
This course comes with the membership.
This course comes with the membership.
So does everything else.
One membership opens every course, certification, workshop and masterclass in the Academy. Every plan starts with a 3-day free trial. You register and book the exam directly with Linux Foundation.
3 days free, then $29.97 a month. Your card is only charged once the trial ends.
Included in every plan
- Every course in the Academy
- Every certification course
- Workshops and masterclasses
- A certificate of completion
- A 3-day free trial
- Learning at your own pace
- The lifetime alumni network
- Upgrades at any time
In practice
Seven roles.
Seven roles.
One credential across them all.
No single job owns it. Here’s where each role leans hardest, and where its work ends up.
- 01Architecture
- 02Network policy
- 03Service mesh
- 04Observability
- 05Installation
- 06Cluster Mesh
- 07eBPF
- 08BGP, external
-
Cilium is both the CNI and the mesh. You install and observe it as one.
Architecture, Observability, Installation
Kubernetes platforms, Multi-cluster environments
-
Policy follows identity, not IP addresses. BGP still joins the cluster to the rest.
Network policy, Cluster Mesh, BGP, external
Cloud-native networking, Multi-cluster environments
-
Identity-based policy follows a pod wherever it moves. eBPF enforces it in the kernel.
Network policy, eBPF
Security teams, Kubernetes platforms
-
Hubble shows who talked to whom and who was dropped. That shortens a network investigation.
Observability, Service mesh
Kubernetes platforms, Cloud-native networking
-
Multi-cluster designs need routing, identity and a plan. Cluster Mesh and BGP supply the pieces.
Architecture, Cluster Mesh, BGP, external
Multi-cluster environments, Cloud-native networking
-
Installing a CNI wrong means redoing the cluster. Installation is its own exam domain.
Installation, Service mesh
Kubernetes platforms, Multi-cluster environments
-
One cluster becomes many sooner than planned. Architecture decides how they connect.
Architecture, Cluster Mesh
Multi-cluster environments, Cloud-native networking
- Kubernetes platforms
- Multi-cluster environments
- Cloud-native networking
- Security teams
Cloud & Platform Engineer
Cilium is both the CNI and the mesh. You install and observe it as one.
Over 10,000 students trust LUNARTECH
LUNARTECH gives you the skills
to learn, build, create and lead.
Engineers
Understand systems all the way down. Build the ones others rely on.
Scientists
Understand what the data says. Build models that hold up.
Researchers
Understand the papers. Build on them, and take the work further.
The field
Anyone can use AI.
Anyone can use AI.
Few can engineer it. This is where that starts.
+340%growth in open roles requiring AI skills
Roles and pay
~35,000 open roles right now
Open roles: Built In, Greenhouse, LinkedIn.
Typical salaries: Glassdoor, Levels.fyi, Payscale, Indeed, Ravio, JobRise, U.S. BLS. Military: 2026 U.S. basic pay, drone officers with aviation incentive pay.
Updated November 2026.
FAQ
Frequently asked questions.
Need help? These answers cover most of what people ask before they start.
No. Linux Foundation issues it. LUNARTECH is independent of Linux Foundation, and its names and marks belong to it. When you finish a course of ours, you earn a LUNARTECH certificate of completion for that course.
No. We design this course ourselves, around what the exam covers. Linux Foundation has no part in it, and you still register and book the exam directly with Linux Foundation.
90 minutes, online, proctored. The passing score is 75%.
The Linux Foundation lists no prerequisites but recommends Kubernetes knowledge and basic networking, including the seven-layer model, TCP, UDP, DNS and HTTP.
2 years.
We last reviewed it on 5 November 2026, from Linux Foundation’s own pages. Details change, so check the official page before you book.
Our 3-day free trial gives you access to a selection of content in the bootcamps, courses and materials, so you can experience the value of our content first-hand. This includes comprehensive learning materials and interactive sessions. You won’t be charged during this period, though we require your credit card details at the start to ensure a seamless transition should you choose to continue.
Yes, entering your credit card details is a necessary step to begin your free trial. The process is entirely secure, and we ask for it to provide a seamless transition to a paid subscription if you decide to continue beyond the trial. You will only be charged after the trial period ends, with full access to our content based on the plan you choose.
After your 3-day free trial you gain access to the full breadth of our content, depending on the subscription plan you choose. We offer free trials for our monthly, bi-annual and annual plans, and each plan provides a different scope of access and benefits.
If your employer has agreed to fund your learning, in part or in full, please contact us at info@lunartech.ai. We’ll work with you and your employer to set up everything needed for your subscription.
Yes. Our support remains strong both during your free trial and after you subscribe. Reach the team at info@lunartech.ai with any question, whether you’re onboarding, navigating your trial, or need help as a member. Subscribers to the yearly plan also receive dedicated support in one-on-one sessions.
You can upgrade your plan at any time during your subscription. Downgrading is not available for bi-annual or annual plans, but you can cancel and then choose a new plan that suits you better. For bi-annual and annual plans we also offer payment in instalments; please reach out to learn more.
The course
Build the skills behind CCA.
Show you understand how Cilium connects, secures and observes a cluster. Start with a free trial, or enroll in a plan and work through the course at your own pace. Linux Foundation runs the exam and issues the credential.
LUNARTECH is independent of the vendors and certifying bodies listed here. Their names, exam titles and marks belong to them, exams are run by them, and credentials are issued by them. Reviewed 5 November 2026. Catalogues change often, so confirm the details on the official page before you book.
