Containing Wildfires in a Sprawling Multi-Cluster Network: The Network's Immune System
summary
Claims a closed loop that detects and contains lateral movement across a two‑cluster Cilium cluster mesh (US‑west and US‑east) by piping Tetragon trace events into a Python quarantine controller which patches pods with quarantine=true label and applies a clusterwide Cilium network policy. Demo shows tracing policies blocking curl at kernel level with exit 137 within milliseconds, and the controller catching an evasion (wrapped curl) to quarantine the pod. Hubble provides traffic visualization of verdicts.
AI-written summary · about
chapters (6)
- 0:00Network immune systems intro
- 3:53Three-pillar defense system
- 8:05High-level setup overview
- 10:11Demo repo and prerequisites
- 16:55Live immune system demo
- 23:37Defense recap and wrap-up
related talks
32mBreaking Boundaries: Multi-cluster with Cilium cluster mesh
35mTurn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
42mPanel - Klustered: eBPF Edition
24mConfluent's Multi-Cloud Journey to Cilium: Pitfalls and Lessons Learned
42mKubernetes Node Firewalling from the Inside Out
31mNetworking Failure Stories: How to Maintain, Break, and Fix Cluster Connectivity
33mDetecting Compromised CI With eBPF and Cilium Tetragon