Containers & Kubernetes-Cilium N/W Policy+Spinnaker Delivery

Cilium secures microservice connectivity on Docker and Kubernetes by applying Linux kernel security policies without code changes, enabling identity-based enforcement and layer 3/4 protocol controls for REST, gRPC, and Kafka.

Set up a local Kubernetes cluster with Minikube, install kubectl and Cilium, then deploy a three-service demo app and enforce L3/L4 policies via endpoint labels.

Apply and test Cilium Kubernetes network policies to enforce ingress rules and least-privilege isolation between microservices, validating access patterns and policy steps seven.

Install the example tiers spec versions 1.7, 1.8, 1.9, and 1.1.0 to export and inspect metrics with psyllium, then restart psyllium to apply new primitives configurations for security policies.

Get started with Istio by deploying Cilium-based networking and psyllium sidecars in a Kubernetes cluster, then deploy a four-service book app (product, details, reviews, reads) with Envoy for traffic control.

Deploy services with a more restrictive psyllium network policy and version 2 of the product service. Verify access to reviews and ratings and observe the authentication audit log in Kafka.

Learn how to enforce secure communication in a Kubernetes environment using Cilium network policies, protecting Kafka topics, and validating authorization across services.

Deploy cilium on kubernetes, configure psyllium components and daemon sets, then deploy a demo kafka application with zookeeper, illustrating security policies and topic-based data streams.

Set up Kafka topics across empire and outpost terminals, test producers and consumers, then apply psyllium network policies with Cilium to restrict traffic.

Set up a local kubernetes cluster with kubectl and minikube, install cilium for GRPC security policies, deploy the GRPC-based demo app, and test client-server access.

Secure access to a gRPC service using cilium network policy, blocking write requests while allowing get name, get location, and request maintenance, by mapping calls and applying policy.

Demonstrate securing Elasticsearch with cilium network policies, enforcing least-privilege access by granting get and put to selected endpoints while denying others through labeled ingress rules, and validating with tests.

Learn to deploy mesos marathon and psyllium on a vagrant vm to apply cilium l3 and l4 policies between a web server and client.

Set up a vagrant-based environment to run cilium and docker containers, verify the cilium agent, and implement label-based L3/L4 security policies for container communication.

Apply and test cilium network policies to enforce least-privilege access between microservices, restricting app1 to the get public API while blocking get private, by creating and deploying a policy file.

Describe the psyllium architecture, including the cilium agent, linux kernel bpf, and container network plugin, and how endpoints, labels, and identities drive policies and visibility.

Explore how the cilium agent manages cluster addresses, ip and ipv6 prefixes, and location-based endpoints, enabling overlay and native routing with identity-based access control for containers.

Install and run cilium in a Kubernetes cluster using the daemonset template, enable automatic IP allocation, and apply network policies from layer 3 to layer 7 for secure connectivity.

Mount the host file system to persist BPA resources and prevent connectivity loss during restarts, while configuring CNI networking with loopback and Cilium plugins via daemon set environment variables.

Deploy and manage the Cilium daemonset in Kubernetes, label nodes, and verify pod readiness and endpoint health; learn standard and extended Cilium network policies for ingress and egress.

Explore migrating Sealyham BPR to cod's, upgrading to a custom resource definition, and verifying cilium CRD deployment for DPR to crt migration in Kubernetes.

Learn how to install cilium and meet minimum requirements for the psyllium container image, including Linux kernel 4.8+, key-value store versions, and kernel configuration options.

Guide the installation and configuration of Kubernetes with Cilium network policy, covering master setup, kubeadm, cni configuration, API server, controller manager, and deploying Cilium daemonset.

Install and configure Kubernetes with Cilium network policy, set up accounts, proxies, and CNI configuration, start services, ensure DNS and kernel compatibility, and prepare for upgrades.

Upgrade Cilium with a Kubernetes rolling upgrade to minimize network disruptions, update RBAC and daemonsets, then monitor and undo if needed while enforcing net policy for ingress and egress.

Define egress rules using endpoint labels and selectors to control traffic, apply default deny, and enforce separation of concerns with labeled requirements for base connectivity and production services.

Explore how Cilium network policy governs ingress and egress with labeled endpoints, L7 rules, and port and header matching, and study endpoint lifecycles from waiting for identity to disconnected.

Explore troubleshooting cilium network policy through policy tracing, verifying endpoint-specific decisions with label-based queries, and monitoring health and metrics across a k8s deployment.

Learn to diagnose and troubleshoot Cilium networking with the cluster diagnosis tool. Perform connectivity checks, inspect packet drops, and retrieve debug data for endpoints and clusters.

Learn end-to-end testing with Cilium using Ginkgo, run runtime and nightly tests, execute focused test cases, and capture logs for post-mortems in a Jenkins workflow.

Learn to extend Cilium tests with Ginkgo features, using before all, after all, and after each hooks to gather logs and debug end-to-end tests across virtual machines.

Master Jenkins-based Cilium network policy testing, including unit and nightly tests with proxy checks, and follow release workflows with backporting and developer certificate of origin.

Explore how committer grant templates streamline nominations to grant access and invitations to accept. Review revocation criteria for inactivity and misconduct to protect project integrity.

Explore how helper functions enable BPF programs to access kernel data and maps, using a common signature and macros, with live examples of map updates.

Develop and test linux kernel bpf/ebpf features for cilium by patching the net tree, cloning with limited history, and running self-tests that depend on llvm 6.

Explore LLVM's bpf backend, compiling C programs to bpf object files, attaching to kernel subsystems via the bpf system call, and handling endianness and debugging options.

Discover pitfalls in writing C for the BPF, including inline code, no function calls on older versions, and no shared libraries, with sectioned ingress and egress programs and map usage.

Explore loading and managing bp programs on linux networking devices, including memory constraints, inline assembly use, and net device offloads via IP out interfaces and XDP workflows.

Explore testing kernel changes with the Linux Dave Sim dummy driver, loading DP BP, DC BP, and CBP programs through two workflows with IP node 2.

Explore the BP tool for introspection and debugging in the Linux kernel, listing and dumping programs and maps, updating, pinning, and querying the BP filesystem.

Examine how bpf programs use maps and instruction streams, with tools for dumping, pretty printing, and interleaving native and kernel execution, to support debugging and analysis.

Explore testing and debugging of the Linux kernel with a self-test suite in the kernel source, including BP program dumps, decompiler outputs, and introspection tools for user-space interactions.

The lecture introduces 18 bp program types and explains xdp, a high-performance bpf framework that runs at the network driver's receive moment and returns a verdict to guide packet processing.

Access the cilium api via cli and golang packages, use subcommands to import, list, and remove network policies, and monitor policy enforcement with debugging and microscope for cluster-wide visibility.

Deploy Spinnaker by monitoring the Spinnaker namespace pods, then verify all components run and open the ui at port 9000 to create an application and prepare a pipeline.

Learn to install Spinnaker on Kubernetes, following magic steps from the docs, including cluster creation, Kubernetes objects, a coordinating pod, and a Spinnaker deployment using a yaml file.

Learn how to install Spinnaker with kubectl, create a namespace and two services for the UI and backend, configure deployment with Helm, and set up external access and storage.