Turn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid
summary
Practical steps to lock down a Kubernetes cluster with Cilium CNPs: enable hostFirewall: enabled=true and apply Cilium HostPolicies that target node labels (control-plane allows kube-apiserver TCP 6443 and etcd sync), run host endpoint policy audit mode before enforce, and expose only needed ports (SSH, ICMP, WireGuard). Use Hubble to see accepted and dropped flows and enable DNS visibility to map names to IPs. Implement cluster-wide policies using namespace labels (e.g. exposed=true, metrics=true) and a default-deny plus per-namespace allow-all to restore internal pod traffic.
AI-written summary · about
chapters (5)
- 0:00Introduction to Cilium policies
- 6:07Securing Kubernetes nodes
- 14:59Protecting infrastructure components
- 26:38Default rules for workloads
- 31:02Q&A session
related talks
21mFrom Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...
41mAdopting Network Policies for Multi-Tenant Environments
31mSecuring Cluster Networking with Network Policies
38mAn Intro to Kubernetes Hardening
20mTackling Container Networking at Scale
42mKubernetes Node Firewalling from the Inside Out
32mBreaking Boundaries: Multi-cluster with Cilium cluster mesh
22mOne Project, Different Angles: How to Secure and Observe with Cilium