Level 7 Egress Control in Kubernetes: Current Solutions,...
summary
Problem: allowing egress to a specific FQDN without opening IP ranges. Demonstrates workable options and limits: GKE FQDN-aware NetworkPolicy (data plane V2) exists now but only on GKE; Cilium NetworkPolicy with SNI support and Istio enforce FQDNs inside clusters but add heavy complexity; hosted proxies like Squid work but require HA and certificate handling; Google Secure Web Proxy and FQDN firewall objects offer managed solutions (DNS-to-IP refresh every ~30s, SNI handling differences). SIG‑Networking is working to standardize FQDN egress in Kubernetes.
AI-written summary · about
chapters (13)
- 0:00Application layer egress control
- 2:16Lock down egress traffic
- 9:11Firewalls fail at domain control
- 12:22Self-hosted solutions pitfalls
- 14:55Squid proxy limitations
- 19:52Hosted vs self-managed proxies
- 22:21Google Secure Web Proxy FQDN
- 26:20Egress control challenges
- 29:52Network Policy limitations
- 31:03Cilium Network Policies
- 33:30Istio service mesh
- 34:12Google FQDN Network Policies
- 35:36Solutions summary
related talks
21mFrom Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...
40mKubernetes Networking Panel: Collaborate on the Spec, Compete on Execution
42mFiltering Network Flows from Kubernetes Clusters: Why and How?
28mHow to Break your Kubernetes Cluster with Networking
25mChallenges with implementing in-kernel FQDN policies using eBPF
35mTurn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid
26mIPv6 First, Not Just Ready: Kubernetes Without IPv4 Using Cilium
01h 28mIntro + Deep Dive: Kubernetes (Network) SIG