Cilium Certified Associate: I Scored 82, and eBPF Was Only 10% of It

I wrote the longer version with the full domain breakdown and my prep notes on my blog.

Most people study for the Cilium Certified Associate like it's an eBPF exam. eBPF is 10% of it.

I passed the CCA on my first attempt with 82 (passing is 75). Of the 15 CNCF certifications on my way to Golden Kubestronaut, this is the one where my networking background helped the least.

Study to the weights

60 multiple-choice questions, 90 minutes, online proctored. The official Linux Foundation weights:

Domain	Weight
Architecture	20%
Network Policy	18%
Service Mesh	16%
Network Observability	10%
Installation and Configuration	10%
Cluster Mesh	10%
eBPF	10%
BGP and External Networking	6%

Architecture, Network Policy and Service Mesh are 54% together. eBPF is about six questions. I see people (me included, partly) pour hours into eBPF internals and BGP while under-preparing Service Mesh, which is worth nearly three times as much as BGP.

Identity, not IP

Cilium runs eBPF programs in the Linux kernel, with no iptables and no kube-proxy required. That's why the CKA only carries you part of the way here. Start with the fundamentals anyway, because the bigger domains assume them:

1. eBPF programs are checked by the verifier at load time. No infinite loops, no invalid memory access.
2. eBPF maps are key-value stores in kernel memory, shared between programs and user space. Cilium uses them for policy enforcement and flow tracking.
3. Every workload gets a numeric identity derived from its pod labels, and policy is enforced on that identity.

If one idea decides your score, it's the third one. The wrong answer is usually some version of "the policy uses the pod's IP". Pod IPs change on every restart, and Cilium's model exists to avoid that dependency. Also know that cilium-agent runs on every node, manages the eBPF programs and maps there, and talks to the Cilium operator.

L7 policy needs Envoy

A CiliumNetworkPolicy with HTTP rules looks like any other YAML:

ingress:
  - fromEndpoints:
      - matchLabels:
          app: frontend
    toPorts:
      - ports:
          - port: "8080"
            protocol: TCP
        rules:
          http:
            - method: GET
              path: /api/v1/.*

Nothing in it tells you those rules silently depend on the Envoy proxy being deployed. The exam gives you a scenario where HTTP filtering doesn't work and asks why. Envoy isn't there.

CiliumNetworkPolicy is namespaced. CiliumClusterwideNetworkPolicy has no namespace and covers the whole cluster. The scenario usually hints at which one it wants.

Service Mesh is where I lost points

I walked in thinking "network policy is network policy" and got hit by questions on transparent encryption modes and certificate-based mutual authentication. That's probably where most of my missing points went.

WireGuard, IPsec and mutual auth are all fair game. I'm not sure whether the exam goes deep on comparing the two encryption modes or only checks that you know both exist. I'd read both sections of the Cilium Service Mesh docs rather than gamble.

Hubble and kube-proxy replacement

Know the per-node Hubble server inside cilium-agent versus Hubble Relay, which aggregates flows across the cluster. Without Relay, hubble observe only shows the local node, and that exact situation is a question. Drill the filters from the Hubble docs: --namespace, --label, --verdict DROPPED, --type l7 --protocol DNS.

With kube-proxy replacement, service lookup goes from O(n) iptables chain traversal to an O(1) map lookup. Know Direct Server Return (responses bypass the load balancer) and when it helps. Skim the IPAM modes and what Cluster Mesh does across clusters while you're there.

Two weeks of prep

About 8 hours went into the free Isovalent labs, which I think are the best resource for this exam: real Cilium clusters with real eBPF in the browser. Do every lab tagged CCA. After each one I wrote the main commands or YAML from memory right away. Reading lab output didn't stick for me, recall did.

Reading the Cilium docs top to bottom didn't work. I spent two hours in the BGP section before realizing it's a small part of a 6% domain. The official CCA study guide maps topics to domains and is a better way to decide what to read.

Result

82, first attempt. The security side cost me points, and the eBPF and Hubble sections gave them back.

I put together a free CCA practice test for my own final review: questions across all eight domains in the same multiple-choice format as the real exam. Use it early, while there's still time to do labs for your weak domains. Sets for the other CNCF exams are at yetmike.com/tests, and my study links for the whole Kubestronaut path live in awesome-kubestronaut.

I only started thinking of Cilium as a kernel platform after the exam. Now I wonder how many of my Service Mesh mistakes were architecture mistakes in disguise.

---

Originally published on yetmike.com