# Networking for Containers and Kubernetes with Calico Implement container networking best practices for performance, reliability, and scalability Tigera will deliver instructor-led training focused on networking for containers and Kubernetes with Calico. Our instructors are field practitioners with extensive hands-on experience in designing and implementing container networking at scale. Our training content incorporates network design best practices and uses hands-on labs to reinforce the learning. ## Estimated Time This is a sixteen-hour intensive course designed to educate attendees on networking for containers and Kubernetes with Calico and fundamental Kubernetes networking concepts. ## Curriculum The following is the curriculum for the sixteen-hour course: - Overview of Kubernetes container network interface (CNI) and why it is needed - Configure and deploy Calico (Open Source, Cloud, Enterprise) as the CNI provider in a Kubernetes environment - Configure Calico IPAM to implement advanced IPAM scenarios - Overview of various networking modes (overlay and non-overlay) supported by Calico - Configure Calico in overlay mode (VXLAN), non-overlay mode (BGP), and advertise Kubernetes services beyond the scope of Kubernetes cluster using BGP - Gain an in-depth understanding of how Kubernetes services is implemented in iptables - Configure and deploy Kubernetes services and Kubernetes DNS - Deploy Calico Cloud and Enterprise Egress Gateway to control egress traffic based on zero-trust workload security principles - Gain an in-depth understanding of the Calico eBPF dataplane - Configure a Kubernetes cluster to use the Calico eBPF dataplane ### Service Components - Instructor-led training - Includes theoretical and lab modules - Delivered to up to fifteen (15) trainees - Dedicated lab environment per trainee - Combination of slides and hands-on product training ### Service Milestones - Training planning and setup - Kubernetes security foundation training ### Deliverables - Lab credentials - Training material ### Who should attend this training? Systems administrators, solutions architects, DevOps engineers, platform engineers, network engineers, and security engineers will benefit from taking this course. ## Training Details The following sections provide details about the activities typically performed as part of this service. ### Training Planning, Setup, and Delivery #### Tigera’s Responsibilities - Work with the customer to determine the list of trainees and training schedule. - Send a remote video conferencing invitation to the trainees, according to the training schedule agreed upon with the customer. - Set up a dedicated lab instance per trainee and deliver the login credential to the trainees. - Deliver the training material document to the trainees. #### Customer’s Responsibilities - Provide Tigera with a list of trainees, along with their contact details and their roles in the organization. - Agree with Tigera on a training schedule, in accordance with the lead time section - Ensure the trainees are available to test the lab access, review the training material document, and attend the training. - Notify Tigera about any issues related to the lab or training material. - Resolve issues related to the training material or lab that are related to the customer environment, such as proxy, web filter, DNS, or firewall issues. #### Deliverables - Deliver three (3) remote training sessions, including some or all of the theoretical and lab modules described in the training curriculum section. - Maintain one (1) lab instance for the trainees for the duration of the training. - Ensure all the trainees participate in the training sessions. ## Training Curriculum ### Course Introduction - Tigera product offerings - The functionalities of Calico Enterprise and Calico Cloud’s main components - Calico-node main processes ### Calico Container Network Interface (CNI) - Why a CNI is necessary - The responsibilities of a CNI - Pod lifecycle - Calico CNI install requirements - Calico CNI logging - Examine CNI configurations ### Calico IPAM - Why Calico IPAM is necessary - How Calico IPAM works - Resources used to configure Calico IPAM - Advanced Calico IPAM features - Calico IPAM best practices ### Calico Cross-Node Networking - Kubernetes networking model - Calico networking modes - Calico BGP configuration resources - How various Calico networking modes work - Calico overlay configuration resources - The difference between various overlay networking modes - Networking mode MTU sizes ### Kubernetes Services & DNS - Why Kubernetes services are necessary - The role of kube-proxy - Different kube-proxy modes - Different types of services - How services are implemented in IPTables - Service discovery in Kubernetes - CoreDNS implementation in Kubernetes - DNS policies in Kubernetes ### Calico Egress Gateway - Why Calico Egress Gateway is necessary - Egress Gateway use cases and characteristics - Egress Gateway health checks - Egress Gateway best practices and governance - Egress Gateway routing and sequence of events - Egress Gateway deployment - How to perform a graceful upgrade of Egress Gateway pods ### Calico eBPF Dataplane - What eBPF is and its key terminologies - Differences between Calico iptables dataplane and eBPF dataplane - How eBPF works under the hood ### Prerequisites Trainees are required to have basic knowledge in Kubernetes networking and security, including: - Basic knowledge in Linux kernel and networking - Basic knowledge in Kubernetes - Basic knowledge in infrastructure networking including BGP routing protocol and overlay networking using IPIP and VXLAN - Basic knowledge in infrastructure security, including firewalls Following is a list of recommended trainings to acquire basic knowledge in Kubernetes and Calico Networking and Security: - [Tigera Academy Certified Calico Operator: Level 1](https://academy.www.tigera.io/course/certified-calico-operator-level-1/) - [The Linux Foundation: Kubernetes Fundamentals (LFS258)](https://training.linuxfoundation.org/training/kubernetes-fundamentals/)