Cilium Network Policy: What You Need to Know for CKS
Cilium network policies are now part of the CKS exam. Here's how they work and what to practise.
This is a short summary. Read the full article on Medium →
The CKS curriculum now covers Cilium network policies. I explain how Cilium extends standard Kubernetes network policies with fine-grained controls from layer 3 to layer 7, and walk through hands-on examples from default-deny to restricted cross-namespace traffic.
Key takeaways
- Cilium gives pods security identities based on their labels and enforces policies on those identities.
- In a zero-trust setup, traffic needs both an egress rule on the sender and an ingress rule on the receiver.
- Use CiliumNetworkPolicy for namespaced rules and CiliumClusterwideNetworkPolicy for cluster-wide ones.
- In the exam you can only use the official Cilium documentation, so practise with it beforehand.