Adopting Network Policies for Multi-Tenant Environments
summary
Explains a practical, risk‑based path from default‑allow to default‑deny using Cilium Network Policies, showing identity‑based rules, DNS‑aware egress and layer‑7 HTTP path/method filters, and cluster‑mesh policies across multi‑tenant clusters. Demonstrates using eBPF for enforcement and Hubble plus Grafana for live flow visibility and policy verdict metrics; uses audit mode then applies four incremental policies to lock down a namespace while preserving access. Shows LB IPAM and LB IPAM/BGP for predictable ingress/egress IPs.
AI-written summary · about
chapters (27)
- 0:00Introduction and speaker intro
- 1:46Talk agenda and goals
- 2:49Zero trust and network policies overview
- 4:14Challenges in adopting network policies
- 6:01Risk reduction strategies
- 7:05Namespace-level security approach
- 8:10Measuring risk exposure metrics
- 9:14Initial network baseline strategy
- 11:00Automation and GitOps for policies
- 12:02eBPF as Cilium's foundation
- 13:05Cilium network policy features
- 15:30DNS-aware and layer 7 policies
- 16:33Cluster-wide and multi-cluster policies
- 17:16Securing ingress and egress traffic
- 18:23BGP control plane and IP allocation
- 19:50Gateway API and load balancer integration
- 21:13Egress Gateway policies
- 22:16Observability with Hubble
- 24:26Live demo introduction
- 26:13Demo: Observing default-allow traffic
- 27:20Demo: DNS-aware network policy
- 28:50Demo: Client and server policies
- 30:36Demo: Securing ingress traffic
- 32:25Demo: Final policy enforcement
- 34:15Demo: Complex tenant example
- 36:00Resources and next steps
- 36:41Q&A session
related talks
28mLessons from Building Scalable Network Policy Enforcement with eBPF
35mTurn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid
21mFrom Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...
31mSecuring Cluster Networking with Network Policies
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
22mRole of eBPF in Kubernetes Networking and Security
25mNetwork Segmentation at Scale: GitOps-Driven Multi-Tenant Isol...
32mBreaking Boundaries: Multi-cluster with Cilium cluster mesh