PDP-03 · Programmable Data Planes
Build the plumbing that connects every container.
Write a CNI plugin by hand, then run a cluster where eBPF enforces policy, balances load and reports every flow.
You build: a working CNI plugin and a policy-enforced cluster network.
Promise
Build a CNI plugin by hand, then run a cluster network with eBPF-based policy, load balancing, and observability.
Prerequisites
PDP-01; basic Kubernetes.
Units
1. The container network model ch 02–04
Linux networking review, the model, the CNI spec.
2. Your own CNI plugin ch 05–06
a hand-built plugin and its Kubernetes integration.
3. eBPF for networking ch 07–09
what eBPF is, the toolchain, a first program.
4. Cilium in practice ch 10–16
architecture, data plane, install, network policy, cluster mesh, observability, service mesh.
5. eBPF data-plane work ch 17–20
load balancing, policy, tuning, process-level identity.
6. Scale and future ch 21–30
multi-tenancy, BGP, IPv6 and dual stack, WireGuard, custom programs, large clusters, technology choice.
Labs
Each lab names its environment and a pass check. Labs are not marked complete on "it ran" — the pass check has to hold.
| Lab | What you do | Environment |
|---|---|---|
| PDP-03ach 05 | Hand-build a veth CNI pluginPass check: Two pods ping each other | vm90 min |
| PDP-03bch 12–13 | Install Cilium and apply a deny policyPass check: Denied flow times out, allowed flow works | container90 min |
| PDP-03cch 14 | Connect two kind clustersPass check: Service reachable from the other cluster | container90 min |
| PDP-03dch 24 | Enable WireGuard encryptionPass check: Captured traffic is encrypted | container60 min |
Capstone project · CAP-04
Multi-Cluster Mesh with Policy · 3 weeks
Two clusters must share three services. Only named flows may cross, all encrypted, all observable.
Build the mesh, the policy, and the SLA dashboard. Show a denied flow and an allowed flow.
Deliverables: Manifests, test suite, dashboard, runbook.
Outcomes
- I can implement the CNI ADD and DEL operations for a simple plugin.
- I can write a Cilium network policy and prove it blocks traffic.
- I can connect two clusters and verify cross-cluster service access.
- I can encrypt pod-to-pod traffic and show it on the wire.
Also in
How it runs
Work through the units in order. Each unit groups the chapters of the study guide with its share of the labs. You can start any time; there is no cohort date and nothing expires.
Labs run in a VM, a container, a simulator or on real hardware, and the card above names which. Where a lab needs hardware — an RDMA NIC, a programmable switch model, an FPGA — there is a simulator fallback so you are never blocked by equipment.
Questions
Do I get a certificate?
You get a completion record for the course. Path badges and project credentials are earned by passing the labs and the project review, not by attendance.
Can my team take this together?
Yes — and if you would rather have it delivered live, with the instructor in the room, this course also exists as a scheduled live cohort. See the live dates.
How long does it take?
≈ 30 h of study including the labs. Most engineers take it part-time over a few weeks.