Meshing It up Securely: How Roche Manages Network Connectivity for...
summary
Roche explains how a cloud‑native edge platform for 1000+ edge clusters replaces dozens of lab devices by routing pod traffic with Cilium Service Mesh (eBPF) to a per‑node Envoy, using Cilium Envoy Configs and custom Envoy filters that implement websocket‑client/server tunneling and TCP/HTTP‑CONNECT forwarding. Traffic to cloud services goes through a Cloudflare static IP range with mTLS (cert‑manager + Vault issuing 7‑day certs), GitOps‑driven policies, Hubble observability; POC succeeds and all EKS clusters migrate to Cilium.
AI-written summary · about
chapters (13)
- 0:00Roche team introduction
- 1:27Legacy lab device issues
- 3:13Edge Kubernetes networking
- 6:43Cloudflare proxy limits
- 7:24Cilium Service Mesh intro
- 9:29Cilium policies and Envoy
- 11:14Edge-to-cloud use case
- 12:58WebSocket tunneling details
- 15:27Cilium migration benefits
- 15:48Customer proxy setup
- 17:33Cilium policies demo
- 21:46Isovalent lab resources
- 22:33Q&A
related talks
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
31mCilium Mesh
10mLightning Talk: Connecting Klusters on the Edge with Deep Dive into Cilium Cluster Mesh
27mCilium Cluster Mesh: The eBPF-Powered Multicluster Solution for Kubernetes
32mBreaking Boundaries: Multi-cluster with Cilium cluster mesh
28mConnecting the World: Your Hands-on Guide To Cilium ClusterMesh and MCS-API
11mCilium Service Mesh
13mWhich Edge Are You on? Service Affinity with Cilium Cluster Mesh