Kubernetes Node Firewalling from the Inside Out
summary
Shows a concrete setup: Talos (OS) boots a four‑node cluster, opens three ports opened (6443 for Kube API, 8472 for VXLAN, and the Talos API) over a WireGuard control channel, then installs Cilium (CNI) via Helm. Demonstrates Cilium enforcing cluster and ebpf host firewall rules that can block host‑network endpoints while Talos still applies nftables, proving in‑cluster declarative host firewalling is possible (demo is flaky but the labeled node indeed ends up blocked by Cilium).
AI-written summary · about
chapters (8)
- 0:00Cluster firewalling intro
- 1:03Securing live cluster
- 8:34Install Cilium CNI with host firewall
- 18:12Deploy workloads and troubleshoot
- 26:30Enforce NetworkPolicy rules
- 30:54Take over host firewall with Cilium
- 37:20Firewalling ownership layers
- 39:05Q&A on default deny
related talks
35mTurn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
39mKubernetes Tower Defense
01h 24mTutorial: Attacking and Defending Kube...
38mAn Intro to Kubernetes Hardening
32mContainer and Kubernetes security policy design
22mNavigating the Kubernetes Networking Maze
01h 27mKubernetes Networking 101