Technical explanation
Masquerading performs source network address translation for qualifying traffic that leaves the cluster. Because pod addresses are often private and not routable by the external network, Cilium replaces the pod’s source address with an address belonging to the egress node. Return traffic can then reach that node, which reverses the translation and delivers the response to the originating pod. B correctly summarizes this behavior.
Masquerading is a form of SNAT, not DNAT. DNAT modifies the destination address, commonly to direct incoming traffic toward another endpoint, so C is incorrect.
Cilium documents its eBPF-based masquerading implementation as the more efficient implementation. The iptables version is the legacy alternative, making A false. Conversely, eBPF masquerading depends on appropriate kernel eBPF capabilities and Cilium’s BPF NodePort functionality. It cannot be assumed to work on every kernel version, so D is false. The legacy iptables implementation is the mode documented as broadly working across kernel versions.
Cilium can exclude natively routable CIDRs from masquerading, and administrators may configure separate IPv4 and IPv6 masquerading behavior.
Official references
Cilium Masquerading , Cilium System Requirements
Study Guide topic: SNAT, native-routing exclusions, and eBPF versus iptables masquerading.
