All Labs

Getting started with eBPF

eBPF is the new standard to program Linux kernel capabilities in a safe and efficient manner without requiring to change kernel source code or loading kernel modules. It has enabled a new generation of high performance tooling to be developed covering networking, security, and observability use cases.

The best way to learn about eBPF is to read the book "What is eBPF" by Liz Rice. And the best way to have your first experience with eBPF programming is to walk through this lab, which takes the opensnoop example out of the book and teaches you to handle an eBPF tool, watch it loading its components and even add your own tracing into the source eBPF code.

Securing AI/ML Workloads with Isovalent Enterprise

Learn how to deploy and manage AI/ML workloads on Kubernetes using Cilium for advanced networking, load balancing, security, and observability. This comprehensive hands-on lab covers ML model training, inference deployment, security monitoring with Tetragon, and API security with network policies.

Cilium: Host Firewall

Ever since its inception, Cilium has supported Kubernetes Network Policies to enforce traffic control to and from pods at L3/L4.

But Cilium Network Policies even go even further: by leveraging eBPF, it can provide greater visibility into packets and enforce traffic policies at L7 and can filter traffic based on criteria such as FQDN, protocol (such as kafka, grpc), etc…

Creating and manipulating these Network Policies is done declaratively using YAML manifests.

What if we could apply the Kubernetes Network Policy operating model to our hosts? Wouldn't it be nice to have a consistent security model across not just our pods, but also the hosts running the pods? Let's look at how the Cilium Host Firewall can achieve this.

In this lab, we will install SSH on the nodes of a Kind cluster, then create Cluster-wide Network Policies to regulate how the nodes can be accessed using SSH.

The Control Plane node will be used as a bastion to access the other nodes in the cluster.

Learning eBPF Tutorial

If you enjoy this tutorial and would like to dive deeper, you may like to consider Liz's book published by O'Reilly, Learning eBPF. You can also download an electronic copy from Isovalent's web site.

Golden Signals with Hubble and Grafana

One of the most important thing when running applications in an environment
like Kubernetes is to have good observability and deep insights.

However, for many organizations it can be challenging to update existing
applications to provide the observability you need. With Cilium, you can use
the Hubble Layer 7 visibility functionality to get Prometheus metrics for
your application without having to modify it at all.

In this lab you will learn how Cilium can provide metrics for an existing
application with and without tracing functionality, and how you can use
Grafana dashboards provided by Cilium to gain insight into how your
application is behaving.

Isovalent Network Policy Governance

Separate platform guardrails from application access. Test before enforcement, use Admin and Normal tiers with Pass, narrow access, apply an explicit deny, and roll back safely.

Securing OpenClaw with Tetragon

Your personal AI assistant, OpenClaw, is running on your server. It can read your files, call APIs, and automate tasks. But what happens when it unearths that resignation letter you never sent, leaks your friend's surprise party plans, messages your friends something embarrassing, and books the wrong restaurant?

In February 2026, researchers found a critical vulnerability in OpenClaw's core gateway that allowed any website to silently hijack a developer's AI agent.

In this lab, you will witness the chaos unfold, observe the damage with Tetragon's security observability, and then enforce runtime security policies to stop OpenClaw from ever misbehaving again — all powered by eBPF in the Linux kernel.

Discovery: Platform Engineer

In this short hands-on discovery lab designed for Platform and DevOps Engineers, you will learn, in 15 minutes, several Cilium features, including:

• Observability
• Built-in Ingress and Gateway API
• Performance Monitoring
• Integration with Grafana
• And more!

Isovalent Runtime Security: Splunk Integration

Learn how to integrate Isovalent Runtime Security with Splunk to create a comprehensive security observability and enforcement platform.

In this hands-on lab, you'll deploy a vulnerable Tomcat application and use Isovalent's eBPF-based runtime security capabilities to:

• Monitor identity-aware process and network events in real-time
• Correlate security data with third-party CVE databases in Splunk
• Detect and visualize CVE-2020-9484 exploitation attempts
• Implement distributed exploit protection using Tetragon TracingPolicies
• Analyze attack patterns and process ancestry trees in Splunk dashboards

You'll experience the complete security lifecycle from vulnerability discovery to threat mitigation, using Vector for log shipping and Splunk's powerful analytics to gain deep insights into runtime behavior. This expert-level lab demonstrates how Isovalent and Splunk work together to provide compensating runtime controls and advanced threat detection for cloud-native environments.

Cilium Cluster Mesh

With the rise of Kubernetes adoption, an increasing number of clusters is deployed for various needs, and it is becoming common for companies to have clusters running on multiple cloud providers, as well as on-premise.

Kubernetes Federation has for a few years brought the promise of connecting these clusters into multi-zone layers, but latency issues are more often than not preventing such architectures.

Cilium Cluster Mesh allows you to connect the networks of multiple clusters in such as way that pods in each cluster can discover and access services in all other clusters of the mesh, provided all the clusters run Cilium as their CNI.

This allows to effectively join multiple clusters into a large unified network, regardless of the Kubernetes distribution each of them is running.

In this lab, we will see how to set up Cilium Cluster Mesh, and the benefits from such an architecture.

Discovery: SecOps Engineer

In this short hands-on discovery lab designed for SecOps Engineers, you will learn, in 15 minutes, several Cilium and Tetragon security features, including:

• Network Observability
• Network Policies
• Transparent Encryption
• Mutual Authentication
• Runtime Security Visibility and Enforcement with Tetragon
• and more!

Migrating from Calico

🚚 Migrating from Calico

Migrating to Cilium from another CNI is a very common task. But how do we minimize the impact during the migration? How do we ensure pods on the legacy CNI can still communicate to Cilium-managed pods during the migration? How do we execute the migration safely, while avoiding a overly complex approach or using a separate tool such as Multus?

With the use of the new Cilium CRD CiliumNodeConfig, running clusters can be migrated on a node-by-node basis, without disrupting existing traffic or requiring a complete cluster outage or rebuild.

In this lab, you will migrate your cluster from an existing CNI to Cilium. While we use Calico in this simple lab, you can leverage the same approach for other CNIs.

Note that this feature is still beta and we expect further tooling and automation to be developed to support large cluster migrations.