Cilium Certified Associate (CCA) Roadmap

Begin with packet and component ownership. Explain the system without using “Cilium does networking” as a shortcut.

• Refresh Pod, Service, EndpointSlice, CNI, Linux namespace, veth, routing, connection tracking, and DNS concepts
• Differentiate the per-node cilium-agent, cilium-cni, cluster-level Operator, Envoy, Hubble Server, Relay, CLI, and UI
• Distinguish the workstation cilium CLI from node-local cilium-dbg
• Trace Pod creation through CNI invocation, endpoint identity, eBPF attachment, and service reachability
• Compare CRD-backed state with optional key-value-store roles
• Draw same-node, cross-node, service, ingress, and egress packet paths
• Explain which functions remain available during a temporary Operator or Relay outage
• Complete Architecture questions 1–4 before moving on

Choose addressing and routing intentionally. These settings are architecture, not harmless toggles.

• Compare cluster-pool, Kubernetes host-scope, multi-pool, CRD-backed, and relevant cloud-native IPAM
• Explain why changing IPAM mode in place can disrupt existing endpoints
• Compare VXLAN and Geneve encapsulation with native routing
• Map tunnel ports, underlay reachability, PodCIDR routing, MTU, and masquerading requirements
• Understand where identity metadata, endpoint policy, service translation, and encryption enter the path
• Inspect CiliumNode, CiliumEndpoint, routes, identities, and service state in a disposable cluster
• Write an architecture decision record for one local and one cloud-like design
• Complete Architecture questions 5–10

Move from IP allowlists to label-derived identity and effective policy.

• Explain how labels become security identities and why identity outlives a Pod IP
• Learn default, always, and never enforcement modes
• Practice independent ingress and egress isolation and additive allow-rule behavior
• Compare portable Kubernetes NetworkPolicy with CiliumNetworkPolicy extensions
• Distinguish namespace-scoped CNP and cluster-scoped CCNP
• Build default-deny plus explicit DNS and service flows
• Use endpoint, namespace, entity, CIDR, FQDN, port, and supported L7 selectors appropriately
• Troubleshoot with endpoint labels, identities, effective policy, and Hubble drop evidence

Separate routing resources, data-plane components, and security claims.

• Configure Cilium Ingress with ingressClassName cilium and understand shared versus dedicated exposure
• Learn GatewayClass, Gateway, HTTPRoute, GRPCRoute, TLSRoute, BackendTLSPolicy, and ReferenceGrant roles
• Use allowedRoutes and grants to constrain cross-namespace trust
• Compare Gateway API's role-oriented model with Ingress
• Explain sidecar-based and sidecarless architectures without claiming sidecarless means proxyless
• Trace eBPF steering into Envoy for supported L7 processing
• Separate TLS termination, backend TLS, mTLS where supported, and transparent node or endpoint encryption
• Validate WireGuard or IPsec scope and documented limits with evidence

Use Hubble as evidence, not as a substitute for testing or authorization.

• Enable Hubble Server, Relay, and UI through a reviewed configuration
• Verify Relay can reach node Hubble APIs and account for TCP port 4244
• Use hubble status to check API health and connected-node coverage
• Filter hubble observe by namespace, workload, verdict, protocol, and other supported fields
• Interpret FORWARDED, DROPPED, and related flow context without overclaiming intent
• Enable only needed L7 visibility and understand Envoy redirection and TLS limits
• Use the UI service map as an observed-window view, not a complete allowed-architecture declaration
• Control payload, identity, retention, and diagnostic-bundle privacy

Make installation reproducible and connect the CLI output to kernel behavior.

• Check system requirements, kernel support, Kubernetes compatibility, and platform prerequisites
• Pin a release and preserve effective Helm or CLI values
• Use cilium install, cilium status --wait, and cilium connectivity test in a disposable cluster
• Use scoped logs, events, cilium-dbg, and protected cilium sysdump evidence for failures
• Understand XDP, traffic-control, cgroup, and socket hooks at an associate level
• Explain eBPF maps for identities, policies, services, connection tracking, and NAT
• State what the verifier checks and what it cannot prove
• Monitor map capacity, kernel compatibility, rollout health, and regression results

Extend reachability without erasing trust boundaries.

• Plan unique cluster names and IDs, compatible versions, addressing, ports, and authentication
• Enable Cluster Mesh only after both clusters pass independent baselines
• Validate remote clusters, shared state, identities, nodes, and cross-cluster policy
• Configure and test global services, backend health, load balancing, and affinity
• Distinguish connectivity from authorization across clusters
• Understand BGP peers, ASNs, advertisement resources or policy, Service and Pod-prefix use cases
• Verify accepted routes, traffic, withdrawal, reconvergence, and prefix filters on the external router
• Use Egress Gateway for scoped stable source identity and test gateway failure

Convert recognition into explanation, operation, failure diagnosis, and recovery.

• Complete the install, connectivity, and Hubble lab from provisioning through teardown
• Complete the identity policy and Gateway service-mesh security lab
• Complete the Cluster Mesh, BGP, and egress failure-recovery platform
• Run all 50 original questions under a 90-minute timer and explain every distractor
• Review 40 flashcards with spaced repetition, emphasizing weak domains rather than familiar cards
• Recreate diagrams from memory: component, packet, identity, Gateway, Hubble, mesh, and BGP paths
• Recheck current official exam details, curriculum, stable docs, APIs, and supported versions
• Schedule only when both recall and hands-on failure diagnosis are repeatable