From Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...
summary
Starts from a wide-open cluster and builds concrete defenses: apply a baseline deny-by-default NetworkPolicy, then introduce Kubernetes NetworkPolicy L3/L4 selectors, add port/protocol restrictions, and move to L7 and FQDN-aware rules enforced by Cilium using eBPF. Demonstrates label-based stable identities vs ephemeral IPs, a deny-all then allow-specific workflow, DNS resolution gating (CoreDNS → external FQDN), cluster-wide vs namespace policies, and debugging tips for common failures.
AI-written summary · about
chapters (13)
- 0:00Kubernetes castle welcome
- 1:28Open gates to hardened walls
- 3:37Workloads with labels
- 5:05L4 policies at gates
- 7:13EBPF network knight mindset
- 9:27Cilium identity security
- 10:11Deny then allow flows
- 12:20L4 filtering by ports
- 13:03Layer 7 HTTP filtering
- 14:50DNS and external access
- 16:57Scaling cluster-wide rules
- 18:22Chaos to protected kingdom
- 19:27Network knight principles
related talks
35mTurn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
05mKeynote: Crossing the Kubernetes Network Policy Chasm
31mSecuring Cluster Networking with Network Policies
40mKubernetes Networking Panel: Collaborate on the Spec, Compete on Execution
41mAdopting Network Policies for Multi-Tenant Environments
41mKubernetes Security Jumpstart
22mSecuring Kubernetes