Learn Cilium - Prerequisite Skills & Environment Setup

#Introduction

Welcome to the Learn Cilium series! This series will take you through mastering Cilium — a CNI (Container Network Interface) based on eBPF for networking, security, and observability in Kubernetes — from conceptual foundations to production readiness. There are 23 episodes in total, arranged in six phases.

Before touching cilium install, there are some foundational skills and software you must have. Why are these prerequisites important? Because Cilium operates at a deeper layer than a regular Deployment file. Cilium compiles eBPF programs into the Linux kernel, replaces the role of kube-proxy, and understands workload identity — all of which demands a basic understanding of how Kubernetes and the Linux kernel work.

This Episode 0 is your roadmap: we will make sure the foundational skills are in place, set up a local test cluster, install the required tooling, and verify the environment for the first time. Once this episode is complete, the rest of the series can be followed comfortably and without friction.

#Required Foundational Skills

#Kubernetes: Pod, Service, and kube-proxy

You must understand the basic Kubernetes objects: Pod as the smallest unit wrapping containers, Service (ClusterIP, NodePort, LoadBalancer) as a network abstraction in front of pods, and kube-proxy as the component that has historically managed network rules (iptables) to forward traffic to pods. Also understand Kubernetes' built-in NetworkPolicy, because Cilium extends this concept much deeper with an identity-based approach.

#Linux Networking and Network Namespaces

Cilium runs inside the kernel, so knowledge of Linux networking is very helpful. The concepts you must know:

• veth: a virtual ethernet pair that connects a pod's network namespace to the host namespace.
• Bridge: the virtual switch that several veths attach to.
• Routing: the process of deciding where a packet should be forwarded.
• iptables: the rule tables historically used by kube-proxy and other CNIs.
• Network namespace: the mechanism for isolating networking between pods and between processes.

Also understand how containers work: a container is a process isolated with namespaces and cgroups. In episode 4 we will see how Cilium replaces iptables chains with eBPF programs that are far faster and do not need to traverse long rule lists.

#Container Runtime and CNI Concepts

CNI is the specification that defines how the runtime (containerd, CRI-O) calls the network plugin to prepare a pod's network namespace. Cilium is one implementation of CNI. Make sure you understand the basic flow: the runtime calls the CNI plugin, the plugin allocates an IP address, the plugin attaches a veth, then pod traffic flows according to the rules compiled into the kernel.

#Software to Prepare

#Local Kubernetes Cluster

To try out all the features, use a local test cluster such as kind, minikube, or k3s. Cilium requires a modern Linux kernel (5.8 or newer) for full eBPF support. First check your host kernel version:

uname -r

If the number is below 5.8, consider upgrading the kernel or using a VM with a newer kernel. Next, create a kind cluster as your experimentation sandbox:

kind create cluster --name cilium-dev
kubectl cluster-info

kubectl cluster-info ensures the connection to the cluster is working normally. Remember one important rule: do not install another CNI first, because we will install Cilium from scratch in episode 3.

#Cilium CLI and hubble CLI

Download the Cilium CLI (v0.19.x) and the hubble CLI from the official GitHub releases. These two tools will be your companions throughout the series:

curl -L --remote-name-all https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz
tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
rm cilium-linux-amd64.tar.gz

A similar process applies to the hubble CLI using the hubble-linux-amd64.tar.gz file from the cilium/hubble repository. If you are using macOS or another architecture, adjust the filename to match your platform.

#Helm and kubectl

Helm is needed because we will discuss chart-based installation in episode 3 and episode 18. Make sure all three are installed correctly:

cilium version
hubble version
helm version --short

cilium version displays the CLI version and the version of the image that will be used at install time. All of the commands above must print their versions without error.

#Verifying the Environment

Before moving on to episode 1, run a thorough verification to make sure everything is ready:

uname -r
kubectl get nodes
cilium version
hubble version
helm version

All five commands above must succeed without errors. kubectl get nodes must show nodes with the Ready status. If any of them fails, fix it first — a strong foundation will make the next 22 episodes feel far lighter.

#Summary of Prerequisites

Here is a recap of what you have prepared in episode 0:

• Kubernetes skills: Pod, Service, kube-proxy, and NetworkPolicy.
• Linux networking: veth, bridge, routing, iptables, and network namespaces.
• CNI concepts: the flow of the runtime calling the network plugin.
• A local test cluster (kind, minikube, or k3s) with kernel 5.8 or newer.
• Cilium CLI, hubble CLI, and Helm installed and verified.

If anything is not yet in place, stop and complete it before continuing. The 22-episode journey ahead will go much more smoothly with this strong footing.

#Closing

Key takeaways:

• Cilium is an eBPF-based CNI: master the kernel and Linux networking basics.
• Understand the Pod, Service, and kube-proxy flow before seeing how Cilium replaces it.
• Use a local cluster with kernel 5.8 or newer so full eBPF features are active.
• Prepare the Cilium CLI, hubble CLI, and Helm from the start.
• Always verify the environment with uname, kubectl, and cilium version.

In the next episode 1, we will discuss the history, background, and why you need Cilium — from Isovalent's internal project in 2017, its evolution into a graduated CNCF project, to the real problems it solves: kube-proxy's limitations, NetworkPolicy that does not understand identity, and the need for high-performance networking. Make sure your cluster is ready, because the Learn Cilium journey has just begun!