Isovalent labs
All Labs
Go + eBPF Development
Learn how to use the cilium/ebpf library to build Go applications that leverage eBPF
for networking, observability, and tracing. This hands-on lab teaches the practical
skills needed to load, manage, and interact with eBPF programs from Go.
You'll learn to work with maps, ring buffers, XDP network hooks, and kernel tracing -
all from Go code.
Isovalent Enterprise: Network Policies
Use Cilium 1.19.5 policy to compose namespaced and cluster-wide decisions, prove deny precedence and HTTP L7 behavior, and refine changes with Hubble, Timescape, and Isopolicy.
Build an eBPF Monitoring Tool for Kubernetes
Build on your eBPF and Go skills to deploy a production-ready HTTP monitoring
tool to Kubernetes. Complete a pre-written monitoring agent, deploy it as a
DaemonSet, and visualize metrics in Grafana.
What you'll learn:
- Complete Go code using the cilium/ebpf library
- Deploy monitoring tools as Kubernetes DaemonSets
- Configure RBAC for eBPF agents
- Export Prometheus metrics from Go applications
- Interpret Grafana dashboards showing eBPF metrics
- Enrich metrics with Kubernetes metadata
Recommended prerequisites: Complete "eBPF for Networking" and "Go + eBPF Development" labs.
Foundations: Getting Started with Kubernetes Networking and Cilium
Dive into the essentials of Kubernetes networking and cloud-native connectivity in this foundational lab. You'll explore key concepts like pod networking, CNI and IPAM, Kubernetes services, ingress, and network policies, gaining a clear understanding of how they work together to enable seamless communication in a distributed environment.
Beyond the basics, this lab highlights critical aspects such as encryption and the integration of Kubernetes with legacy workloads like BGP and egress gateways. You'll learn how these features extend Kubernetes' networking capabilities to meet diverse infrastructure needs.
Finally, discover how eBPF elevates traditional networking approaches by enhancing scalability, security, and performance. Through practical insights and hands-on exercises, this lab empowers you to master Kubernetes networking fundamentals and explore cutting-edge cloud-native innovations.
Discovery: Cloud Architect on Azure
This discovery lab offers a hands-on journey through modern Microsoft Azure cloud architecture using Cilium and Tetragon. You’ll explore key cloud-native networking and security concepts in an enterprise-grade environment powered by AKS.
Through guided challenges, you'll explore Cilium on AKS and dive into advanced features like Egress Gateway, Gateway API, runtime security, and more—designed to mirror real-world scenarios.
Getting Started with Cilium
Install Cilium on Kubernetes, use Hubble to inspect traffic, and secure the Death Star from L3 to L7. Then publish it with Gateway API, enable WireGuard encryption, and repair a broken route from live Kubernetes evidence.
Kubernetes Packet Capture with Isopcap
Isopcap brings Kubernetes-native packet capture to your cluster. A lightweight DaemonSet agent watches PacketCapture custom resources and captures traffic for the pods you select — without modifying, restarting, or injecting sidecars into your workloads, and independently of which CNI you run.
In this hands-on lab you'll use the pre-installed Isopcap agent to run your first capture against a labeled workload and confirm real packets were recorded. You'll then narrow a capture with a BPF filter and size/duration bounds, retrieve the resulting PCAPng file, and inspect it with tcpdump.
Finally, you'll go beyond static captures and configure a metric trigger that ends a capture early when TCP resets spike — the foundation for "capture only when something interesting happens." You'll then put it all together in a real-world debugging scenario, using protocol-targeted captures to find the root cause of an app team's "HTTP drops" and latency. Next, you'll ship finished captures to an S3-compatible bucket with the agent's built-in upload sidecar and pull a trace back with s3cmd, without touching a node. A quiz and a practical exam close the track so you can prove you can target, filter, and trigger captures on demand.
Isovalent Enterprise: Connecting and Securing MCP Servers on Kubernetes
The Model Context Protocol (MCP) is how AI agents reach tools and systems, and increasingly those MCP servers run on Kubernetes. This lab looks at MCP from a platform engineer's seat: how MCP servers talk, where they run, and how you observe and secure them.
You will run a Kubernetes MCP server over HTTP and watch its calls with Hubble, then restrict it with a Cilium NetworkPolicy. You will then run the same job over a local stdio server, discover why the network tools go blind, and bring in Tetragon at the process layer. Along the way you will meet a real access-control bypass (CVE-2026-46519) and, in the exam, write the Tetragon policy that stops it.
Discovery: Cloud Architect on AWS
This discovery lab offers a hands-on journey through modern AWS cloud architecture using Cilium and Tetragon. You'll explore key cloud-native networking and security concepts in an enterprise-grade environment powered by EKS.
Through guided challenges, you'll install Cilium on EKS and dive into advanced features like Egress Gateway, Gateway API, multicast, runtime security, and more—designed to mirror real-world scenarios.
Cilium: Up and Running - Companion Lab
Companion lab for the O'Reilly book "Cilium: Up and Running" - execute the book's examples in a live environment.
This lab provides a sandbox environment where you can follow along with each chapter of the book, executing the same commands and examples in a live Kubernetes environment.
Navigate through the chapters at your own pace - you can skip around or follow the book's order as you prefer.
Getting Started with Tetragon
Security Observability is a new paradigm that utilizes eBPF, a Linux kernel technology, to allow Security and DevOps teams, SREs, Cloud Engineers, and Solution Architects to gain real-time visibility into Kubernetes and helps to secure your production environment with Tetragon.
Tetragon is an open source Security Observability and Runtime Enforcement tool from the makers of Cilium. It captures different process and network event types through a user-supplied configuration to enable security observability on arbitrary hook points in the kernel; then translates these events into actionable signals for a Security Team.
The best way to learn about Security Observability and Cilium Tetragon is to read the book "Security Observability with eBPF" by Jed Salazar and Natalia Reka Ivanko. And the best way to have your first experience with Tetragon is to walk through this lab, which takes the Real World Attack example out of the book and teaches you how to detect a container escape step by step!
Cilium LoadBalancer IPAM and L2 Service Announcement
In this lab, you will learn about the L2 Load Balancer announcement system in Cilium which allows to publicize LoadBalancer on the underlying network services using ARP.