Isovalent labs

All Labs

Advanced BGP Features

Connect Cilium to an emulated data-center fabric. Use Cilium OSS to tune timers, authenticate a peer, advertise an interface address, and control route attributes. Then use Isovalent Networking for Kubernetes (INK) for Route Import and BFD.

SCTP on Cilium

SCTP is a popular signalling protocol, used primarily by service providers and mobile operators.

SCTP support for Kubernetes Services, Endpoint and NetworkPolicy was introduced in Kubernetes 1.12 (Beta) and was eventually graduated to Stable in Kubernetes 1.20.

Basic support for SCTP was introduced in Cilium 1.13.

This lab will walk you through SCTP communications, security and flow visibility.

Discovery: Cloud Network Engineer

In this short hands-on discovery lab designed for Cloud Network Engineers, you will learn, in 15 minutes, several Cilium networking features, including:

  • Dual Stack IPv4/IPv6 support with Cilium
  • BGP
  • Load-Balancer IPAM
  • L2 Service Announcement
  • Egress Gateway
  • And more!

Isovalent Enterprise: Zero Trust Visibility

Creating the right Network Policies can be difficult. In this lab, you will use Hubble metrics to build a Network Policy Verdict dashboard in Grafana showing which flows need to be allowed in your policy approach.

Cilium Transparent Encryption with IPSec and WireGuard

Encryption is required for many compliance frameworks. Kubernetes doesn’t natively offer pod-to-pod encryption. To offer encryption capabilities, it’s often required to implement it directly into your applications or deploy a Service Mesh. Both options add complexity and operational headaches.

Cilium actually provides <strong>two</strong> options to encrypt traffic between Cilium-managed endpoints: IPsec and WireGuard. In this lab, you will be installing and testing both features and will get to experience how easy it is to encrypt data in transit with Cilium.

You will also see how to encrypt specific pod-to-pod traffic using Isovalent Enterprise.

Detecting VoidLink Malware with Tetragon Enterprise

VoidLink is a sophisticated multi-stage malware toolkit that uses fileless execution techniques,
process name masquerading, and kernel module loading to compromise Linux and Kubernetes workloads.
In this lab, you will observe the VoidLink attack chain in a safe, sandboxed environment.
You will begin with process events and TracingPolicies that are fully compatible with open source
Tetragon, then use File Integrity Monitoring from Isovalent Enterprise for Tetragon to protect
VoidLink's file artifacts.

You will learn to:

  • Understand VoidLink's multi-stage loader architecture (Stage 0 → Stage 1 → Implant → Rootkit)
  • Observe Tetragon events exposing syscall-level behavior (prctl, memfd_create, execveat, finit_module)
  • Write OSS-compatible TracingPolicy CRDs to detect process masquerading and fileless execution
  • Apply enforcement actions (Sigkill, Override) to terminate malicious processes
  • Use Enterprise File Integrity Monitoring to block access to VoidLink artifacts
  • Independently write a detection policy for VoidLink's C2 control channel

Cilium Envoy L7 Proxy

Envoy is a powerful L7 proxy which can be used for many Service Mesh needs.

Cilium uses Envoy for L7 Network Policies, L7 observability,
L7 internal load-balancing, and even allows users to configure Envoy for their own needs.

Cilium Egress Gateway

Kubernetes changes the way we think about networking. In an ideal Kubernetes world, the network would be entirely flat and all routing and security between the applications would be controlled by the Pod network, using Network Policies.

In many Enterprise environments, though, the applications hosted on Kubernetes need to communicate with workloads living outside the Kubernetes cluster, which are subject to connectivity constraints and security enforcement. Because of the nature of these networks, traditional firewalling usually relies on static IP addresses (or at least IP ranges). This can make it difficult to integrate a Kubernetes cluster, which has a varying —and at times dynamic— number of nodes into such a network.

Cilium’s Egress Gateway feature changes this, by allowing you to specify which nodes should be used by a pod in order to reach the outside world.

Isovalent Enterprise: TLS Visibility

In this scenario, we are going to show how Isovalent Enterprise can provide visibility into TLS traffic.

In security audits, a company or team has to verify their application protects data in transit and doesn't leak information during communication, especially when data leaves a sensitive internal network. Mechanisms like TLS ensure that data is encrypted in transit, but verifying that a TLS configuration is secure becomes a challenge for most companies.

In this lab, you will learn how Isovalent Enterprise can:

  • Identify the version of TLS being used, informing us if an obsolete and insecure version is being used
  • Report on the cipher being used
  • Export events in JSON format to SIEM

Isovalent Enterprise: Security Visibility

In this scenario, we are going to simulate the exploitation of a nodejs application, with the attacker spawning a reverse shell inside of a container and moving laterally within the Kubernetes environment.

We will demonstrate how the combined Process and Network Event Data:

  • identify the suspicious Late Process Execution
  • tie the suspicious processes to a randomly generated External Domain Name
  • trace the Lateral Movement and Data Exfiltration of the attacker post-exploit

BGP on Cilium

Learn how to connect your Kubernetes Clusters with your on-premises network using BGP.

As Kubernetes becomes more pervasive in on-premise environments, users increasingly have both traditional applications and Cloud Native applications in their environments.

In order to connect them together and allow outside access, a mechanism to integrate Kubernetes and the existing network infrastructure running BGP is needed. Cilium offers native support for BGP, exposing Kubernetes to the outside and all the while simplifying users’ deployments.

Isovalent Enterprise: Multicast

Multicast support in Kubernetes has finally come to Cilium!

In this lab, you will discover how to set it up, take advantage of it, and observe multicast traffic in Kubernetes, using Cilium and Tetragon in Isovalent Enterprise.