One Project, Different Angles: How to Secure and Observe with Cilium
summary
Cilium uses eBPF to provide CNI networking, an optional per-node Envoy-based service mesh, Hubble observability, and Tetragon runtime security. Install via Helm or the cilium CLI, enable WireGuard or IPSec encryption, and apply CiliumNetworkPolicies that enforce L3–L7 rules and optional mutual authentication via SPIRE (beta). Hubble emits metrics to Prometheus/Grafana and shows allowed/dropped flows. Tetragon hooks kprobes/uprobes/tracepoints, filters with selectors, and triggers actions like SIGKILL enforcement via Tetragon for live response.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:05What is Cilium
- 3:56Cilium’s three pillars
- 6:25Networking features
- 8:11Network policies and service mesh
- 9:57Layer 7 filtering
- 11:45Observability with Hubble
- 14:15Security with Tetragon
- 16:47Tetragon policies
- 19:16Next steps
- 21:41Q&A
related talks
20mTackling Container Networking at Scale
36mCilium: Welcome, Vision and Updates
28mSimplifying the Networking and Security Stack With Cilium, Hubble, and Tetragon
37mScaling up and Scaling Out Networking, Observability, and Security...
01h 13mCilium Workshop
43mA Guided Tour of Cilium Service Mesh
31m10 Years of Cilium: Connecting, Securing, and Simplifying the Cloud Nat...
27mCilium in Practice: Building Data Sandboxes at Bloomberg