Cilium Service Mesh Ingress & Gateway Quiz
This quiz tests your understanding of Cilium Ingress Controller, Gateway API, TLS termination, and EKS integration patterns.
Quiz Questions
1. What does 'shared' mode mean in Cilium Ingress Controller's loadbalancerMode option?
A. Creates a separate load balancer for each Ingress B. All Ingresses share one load balancer C. Uses NodePort only without load balancer D. Handles only internal traffic
Show Answer
Answer: B. All Ingresses share one load balancer
Explanation: The loadbalancerMode: shared setting makes all Ingress resources use a single shared load balancer. This is cost-effective, while dedicated mode creates a separate load balancer for each Ingress.
2. What is the role of the parentRefs field in Gateway API's HTTPRoute?
A. Define parent Pod B. Specify which Gateway this route connects to C. Reference parent namespace D. Define policies to inherit
Show Answer
Answer: B. Specify which Gateway this route connects to
Explanation: parentRefs specifies which Gateway the HTTPRoute connects to. By referencing the Gateway's name and namespace, it determines which listener the route applies to.
3. What annotation enables TLS passthrough in Cilium Ingress?
A. ingress.cilium.io/tls-mode: passthrough B. ingress.cilium.io/tls-passthrough: "true" C. cilium.io/tls: passthrough D. nginx.ingress.kubernetes.io/ssl-passthrough
Show Answer
Answer: B. ingress.cilium.io/tls-passthrough: "true"
Explanation: The ingress.cilium.io/tls-passthrough: "true" annotation forwards TLS traffic directly to the backend service without terminating it. This is useful when the backend needs to handle TLS.
4. What field is used in Gateway API's Gateway resource to support multiple protocols?
A. protocols B. listeners C. endpoints D. handlers
Show Answer
Answer: B. listeners
Explanation: Multiple listeners can be defined in the Gateway's listeners field to support various protocols such as HTTP, HTTPS, TCP, TLS. Each listener can configure protocol, port, hostname, etc. individually.
5. What annotation is required to use NLB with Cilium Ingress on EKS?
A. service.kubernetes.io/load-balancer-type: nlb B. service.beta.kubernetes.io/aws-load-balancer-type: "nlb" C. eks.amazonaws.com/load-balancer: nlb D. aws.load-balancer/type: network
Show Answer
Answer: B. service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
Explanation: To use Network Load Balancer on AWS EKS, add the service.beta.kubernetes.io/aws-load-balancer-type: "nlb" annotation to the service. Additional annotations like scheme, target-type can further configure NLB behavior.
6. What filter type is used to configure URL rewriting in Gateway API's HTTPRoute?
A. PathRewrite B. URLRewrite C. RequestTransform D. PathModifier
Show Answer
Answer: B. URLRewrite
Explanation: In the HTTPRoute's filters section, type: URLRewrite is used to rewrite request URLs. Both path and hostname can be modified.
7. What Gateway setting is needed to allow cross-namespace routing in Cilium Gateway API?
A. allowedRoutes.namespaces.from: All B. allowedRoutes.namespaces.from: Selector C. crossNamespace: true D. routes.scope: cluster
Show Answer
Answer: B. allowedRoutes.namespaces.from: Selector
Explanation: In Gateway's listeners, setting allowedRoutes.namespaces.from: Selector allows routes only from namespaces with specific labels using a selector. 'All' allows all namespaces, and 'Same' allows only the same namespace.
8. What Envoy resource type is used to configure service health checks in CiliumEnvoyConfig?
A. envoy.config.listener.v3.Listener B. envoy.config.cluster.v3.Cluster C. envoy.config.route.v3.Route D. envoy.config.endpoint.v3.Endpoint
Show Answer
Answer: B. envoy.config.cluster.v3.Cluster
Explanation: Health check settings are defined in the health_checks field of the Cluster resource. HTTP health checks, TCP health checks, intervals, thresholds, etc. can be configured.
9. What is the recommended statusCode when redirecting from HTTP to HTTPS in Gateway API?
A. 302 (Found) B. 307 (Temporary Redirect) C. 301 (Moved Permanently) D. 303 (See Other)
Show Answer
Answer: C. 301 (Moved Permanently)
Explanation: For permanent redirect from HTTP to HTTPS, status code 301 is recommended. This informs browsers and search engines that the URL has permanently changed, which is beneficial for caching and SEO.
10. What is the main difference between Cilium and AWS Load Balancer Controller?
A. Cilium only supports L4 B. AWS LBC provides lower latency C. Cilium uses only node resources without additional LB costs D. AWS LBC fully supports Gateway API
Show Answer
Answer: C. Cilium uses only node resources without additional LB costs
Explanation: Cilium Ingress/Gateway handles external traffic using node's eBPF and Envoy, so there are no separate AWS load balancer costs. In contrast, AWS LBC provisions ALB/NLB incurring additional costs.
11. What is TCPRoute used for in Gateway API?
A. HTTP traffic routing B. Traffic requiring TLS termination C. Raw TCP traffic routing (non-HTTP) D. UDP traffic only
Show Answer
Answer: C. Raw TCP traffic routing (non-HTTP)
Explanation: TCPRoute is used to route raw TCP traffic that is not HTTP, such as database connections and message queues. It works with Gateway's TCP listener to provide external access to non-HTTP services.
12. What NLB setting is used to preserve client IP in Cilium Ingress?
A. X-Forwarded-For header B. Proxy Protocol C. Disable Source NAT D. Direct Server Return
Show Answer
Answer: B. Proxy Protocol
Explanation: To preserve client IP with NLB, Proxy Protocol must be enabled. Use the service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*" annotation. Envoy extracts the original client IP from the Proxy Protocol header.