Advanced|15 hours|30 lessons

eBPF & Cilium for Platform Engineers

Understand eBPF deeply enough to reason about it, and Cilium well enough to run it in production. Covers how eBPF works in the kernel, why it is transforming networking, security, and observability, and how Cilium uses it to replace iptables, secure service-to-service traffic, and give you deep visibility. Built for platform engineers running modern eBPF-based infrastructure.

Text-based, no videos

6 modules, 30 lessons

Lifetime access

What you'll learn

What eBPF actually is: sandboxed kernel programs, the hooks they attach to, and the lifecycle from bytecode to a running program

Why the verifier makes kernel code safe, what it rejects, and how its constraints shape what eBPF can and cannot do

How eBPF maps hold state and move data between the kernel and user space, and which map type fits which job

Why iptables stops scaling in Kubernetes, and how XDP, tc, eBPF load balancing, and eBPF conntrack replace it

How Cilium is built: the agent, the operator, security identities, and the eBPF datapath a packet actually travels

Running Cilium as a CNI: IPAM, tunnel versus native routing, cluster mesh, bandwidth management, and egress gateways

Identity-based and L7-aware network policy, transparent encryption with IPsec or WireGuard, and the sidecar-free service mesh

Tetragon for eBPF runtime security enforcement, and where it fits alongside detection-only tooling

Hubble flow visibility and eBPF-derived metrics, plus production troubleshooting and performance tuning at scale

A capstone: designing the networking, security, and observability layer of a multi-cluster platform end to end

Curriculum

6 modules · 30 lessons

eBPF Foundations

What eBPF actually is, how programs attach and run, why the verifier makes kernel code safe, how maps hold state, and the tooling ecosystem built on top.

5 lessons

What eBPF Actually Is30 minFREE How eBPF Programs Run: Hooks, Events, and the Lifecycle30 minFREE The Verifier and Safety30 minFREE eBPF Maps: Sharing State30 minFREE The eBPF Ecosystem and Tooling30 minFREE

eBPF for Networking

Why iptables stopped scaling, and how eBPF replaces it: XDP and tc, load balancing, connection tracking and NAT, and full kube-proxy replacement.

5 lessons

Why iptables Doesn't Scale30 min XDP and tc: eBPF at the Network Edge30 min eBPF-Based Load Balancing30 min Connection Tracking and NAT in eBPF30 min Replacing kube-proxy30 min

Cilium Fundamentals

What Cilium is and how it is built: architecture, the eBPF dataplane, identities and endpoints, installation and day-2 operations, and Cilium-specific debugging.

5 lessons

What Cilium Is and Why It Exists30 min Cilium Architecture30 min The Cilium Dataplane30 min Installing and Operating Cilium30 min Debugging Cilium30 min

Cilium Networking

Cilium as a CNI in practice: IPAM and pod networking, tunnel versus native routing, multi-cluster connectivity, bandwidth management, and controlled egress.

5 lessons

Cilium as a CNI30 min Routing Modes: Tunnel vs Native30 min Cluster Mesh: Multi-Cluster Networking30 min Bandwidth Management and QoS30 min Egress Gateway and External Connectivity30 min

Cilium Security

Security built on the same datapath: identity-based and L7-aware policy, transparent encryption, Tetragon for runtime enforcement, and the sidecar-free service mesh.

5 lessons

Identity-Based Network Policy30 min L7-Aware Network Policy30 min Transparent Encryption30 min Tetragon: Runtime Security Enforcement30 min Cilium Service Mesh30 min

Observability and Production

Seeing and running the thing: Hubble flow visibility, eBPF-derived metrics, production troubleshooting, performance tuning, and a full platform design capstone.

5 lessons

Hubble: Network Observability30 min eBPF-Based Metrics and Monitoring30 min Troubleshooting Production eBPF/Cilium Issues30 min Performance Tuning eBPF/Cilium30 min Capstone: Design an eBPF-Powered Platform45 min

About the Author

Sharon Sahadevan

AI Infrastructure Engineer

Building production GPU clusters on Kubernetes. H100s, large-scale model serving, and end-to-end ML infrastructure across Azure and AWS.

10+ years designing cloud-native platforms with deep expertise in Kubernetes orchestration, GitOps (Argo CD), Terraform, and MLOps pipelines for LLM deployment.

Author of KubeNatives, a weekly newsletter read by 3,000+ DevOps and ML engineers for production insights on K8s internals, GPU scheduling, and model-serving patterns.

Ready to master this topic?

Start with the free preview lesson and see for yourself.