Discuss Linux Foundation Cilium-Associate Exam Topic 5 Question 4

What is the issue with the following egress gateway manifest specification?

Egress gateway manifest exhibit

AThe manifest cannot specify both an interface and an egress IP.

BCilium egress gateway manifests only support one label selector.

CThe egress IP must be taken from a public IP address CIDR.

DOnly interfaces named eth* can be used with Cilium egress gateway

Suggested Answer: A

The manifest specifies both interface: net1 and egressIP: 10.3.4.5 in the same egressGateway configuration. These properties are mutually exclusive. Cilium ignores an Egress Gateway policy containing both, so A correctly identifies the defect.

When interface is supplied, Cilium uses the selected interface and chooses its first suitable IPv4 and IPv6 addresses as the SNAT addresses. When egressIP is supplied, that address must already be assigned to a network device on the chosen gateway node; Cilium determines the corresponding interface through a route lookup. Administrators may also omit both fields, causing Cilium to select the default-route interface and its addresses.

Option B is incorrect because matchLabels can contain multiple label key-value pairs, as the exhibit does with app: blog and component: backend. Option C is false because the egress address need not be publicly routable; private addresses are valid when routing and upstream network design support them. Option D is false because Cilium does not restrict gateway interfaces to names beginning with eth.

Official references

Cilium Egress Gateway

Study Guide topic: Egress Gateway node selection, interface selection, and SNAT addresses.

Get Premium Cilium-Associate Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

8 comments · newest first

Keneth 3 days ago

C is correct, egress IPs need to be public CIDR.

Mila 8 days ago

Wait, are you sure about B? I thought it could support multiple selectors.

Yolande 13 days ago

Totally agree, that’s a common mistake!

Jamal 19 days ago

A) The manifest cannot specify both an interface and an egress IP.

Glenna 24 days ago

I vaguely recall something about interface naming conventions, but I'm not certain if it specifically has to be eth* for Cilium egress gateways.

Genevive 29 days ago

I feel like the egress IP needs to be a public IP address, but I can't remember if that's a strict requirement or just a recommendation.

Bernardine 1 month ago

I think I saw a practice question that mentioned something about label selectors in egress manifests, but I can't recall if it's limited to just one.

Rickie 1 month ago

I remember discussing how egress gateways work, but I'm not sure if the issue is about specifying both an interface and an egress IP.

Linux Foundation Cilium-Associate Exam - Topic 5 Question 4 Discussion