Isovalent labs

All Labs

Cilium Gateway API with cert-manager

Configure Cilium Gateway API HTTPS listeners with cert-manager, follow the Gateway-to-Certificate-to-Secret workflow, set certificate renewal policy, and verify end-to-end TLS routing.

eBPF Networking

Deep dive into Linux kernel networking and eBPF hook points for both networking use cases (packet processing, filtering, load balancing) and observability use cases (connection tracking, latency measurement, flow monitoring). Learn how production tools like Cilium, Hubble, and Katran use these patterns.

Cilium LoadBalancer IPAM and BGP Service Advertisement

BGP support was initially introduced in Cilium 1.10 and subsequent improvements have been made since, such as the recent introduction of IPv6 support in Cilium 1.12.

In Cilium 1.13, that support was enhanced with the introduction of Load Balancer IPAM and BGP Service address advertisements.

In this lab, you will learn about both these new features and how they can simplify your network connectivity operations.

Isovalent Enterprise: Connectivity Visibility with Hubble Timescape

Investigate Kubernetes connectivity with Hubble CLI and Hubble Timescape. Build a service map, enrich flows with DNS and HTTP context, enforce trusted egress, and correlate historical drops with network policy changes.

Cilium Gateway API

In this short lab, you will learn about Gateway API, a new Kubernetes standard on how to route traffic into a Kubernetes cluster. The Gateway API is the next generation of the Ingress API.

Gateway API addresses some the Ingress limitations by providing an extensible, role-based and generic model to configure advanced L7 traffic routing capabilities into a Kubernetes cluster.

In this lab, you will learn how you can use the Cilium Gateway API functionality to route HTTP and HTTPS traffic into your Kubernetes-hosted application, including load balancing / traffic splitting and TLS passthrough or termination.

Cilium for Virtual Machines with KubeVirt

In this lab, you will learn how to leverage KubeVirt to run virtual machines alongside containers in Kubernetes, while using Cilium for secure, scalable networking.

The lab will guide you through integrating VMs with Kubernetes' CNI via Cilium, implementing Zero Trust security policies, and enabling advanced networking features like live migration.

By the end, you'll understand how Cilium and KubeVirt provide seamless networking for both containerized and virtualized workloads in a cloud-native environment.

Getting Started with the Isovalent Load Balancer

Deploy the Isovalent Load Balancer inside Kubernetes and put it in front of production-style application traffic.

Configure VIPs, HTTP and TLS services, weighted and sticky backends, BGP peering, and central load balancing for two application clusters.

Advanced Gateway API Use Cases

This lab is a follow-up to the introductory Cilium Gateway API lab.
We highly recommend you do the Cilium Gateway API lab first, if you haven’t done it already.

In this one, you will learn about some additional specific use cases for Gateway API:

  • HTTP request & response header rewrite
  • HTTP redirect, rewrite and mirror
  • Cross-namespace routing
  • gRPC routing
  • East-West L7 routing with GAMMA

Cilium Ingress Controller

You already know that Cilium accelerates networking, and provides security and observability in Kubernetes, using the power of eBPF. Now Cilium is bringing those eBPF strengths to the world of Service Mesh. Cilium Service Mesh features eBPF-powered connectivity, traffic management, security and observability.

In this lab, you will learn how you can use Cilium to deploy Ingress resources to dynamically configure the Envoy proxy provided with the Cilium agent.

And all of the above without any Envoy sidecar injection into your pods!

GitOps Platform Engineering with Cilium

Dive into the essentials of GitOps platform engineering for Kubernetes networking in this hands-on lab. You'll build a workflow that connects Argo CD, Gitea, Kyverno, Gateway API, Cilium, Timescape, and isopolicy CI so network changes move through Git, review, validation, and automated sync.

Beyond the basics, this lab highlights how platform teams can give application teams a safe self-service path for Cilium network policy and HTTPRoute changes. You'll see how pull requests, policy analysis, admission guardrails, and Argo CD reconciliation work together to catch mistakes before they reach production.

Finally, use Timescape to troubleshoot a real application-team incident by correlating flow history with policy changes. Through practical exercises, this lab shows how GitOps, Cilium, and observability create a platform where networking changes are auditable, recoverable, and ready for production workflows.

Cilium Gateway API: External Authentication

Learn how to use the Gateway API HTTPExternalAuthFilter (GEP-1494) with Cilium
to add authentication in front of any Kubernetes service — without modifying the
application itself.

In this lab, you will:

  • Protect an HR dashboard with Authelia single sign-on (cookie-based)
  • Authorize a machine-to-machine workflow (the Monday-morning headcount report) using OIDC bearer tokens
  • Fine-tune which headers the authorizer sees and which identity headers reach your app
  • Give an AI agent scoped access to an MCP server with the same authorizer
  • Apply what you've learned by securing the app for both humans and a read-only agent in the exam

We recommend completing the introductory
Cilium Gateway API lab first.

Cilium IPAM

Kubernetes pods are transient resources with dynamic IP addresses. For this reason, IPAM is a central component of Kubernetes administration.

In tunneling mode, Kubernetes IPAM is usually configured to distribute IP addresses from a reserved private range, which is the most simple option.

In direct routing mode, where the aim is to integrate the Kubernetes platform into the underlying network fabric, IPAM can become more complex and require more advanced options.

In this lab, we will explore the various IPAM options provided by Cilium.