Isovalent labs

All Labs

Cilium Gateway API with cert-manager

Configure Cilium Gateway API HTTPS listeners with cert-manager, follow the Gateway-to-Certificate-to-Secret workflow, set certificate renewal policy, and verify end-to-end TLS routing.

Cilium Gateway API: External Authentication

Learn how to use the Gateway API HTTPExternalAuthFilter (GEP-1494) with Cilium
to add authentication in front of any Kubernetes service — without modifying the
application itself.

In this lab, you will:

  • Protect an HR dashboard with Authelia single sign-on (cookie-based)
  • Authorize a machine-to-machine workflow (the Monday-morning headcount report) using OIDC bearer tokens
  • Fine-tune which headers the authorizer sees and which identity headers reach your app
  • Give an AI agent scoped access to an MCP server with the same authorizer
  • Apply what you've learned by securing the app for both humans and a read-only agent in the exam

We recommend completing the introductory
Cilium Gateway API lab first.

Build an eBPF Monitoring Tool for Kubernetes

Build on your eBPF and Go skills to deploy a production-ready HTTP monitoring
tool to Kubernetes. Complete a pre-written monitoring agent, deploy it as a
DaemonSet, and visualize metrics in Grafana.

What you'll learn:

  • Complete Go code using the cilium/ebpf library
  • Deploy monitoring tools as Kubernetes DaemonSets
  • Configure RBAC for eBPF agents
  • Export Prometheus metrics from Go applications
  • Interpret Grafana dashboards showing eBPF metrics
  • Enrich metrics with Kubernetes metadata

Recommended prerequisites: Complete "eBPF for Networking" and "Go + eBPF Development" labs.

Getting Started with Cilium

Install Cilium on Kubernetes, use Hubble to inspect traffic, and secure the Death Star from L3 to L7. Then publish it with Gateway API, enable WireGuard encryption, and repair a broken route from live Kubernetes evidence.

Advanced Gateway API Use Cases

This lab is a follow-up to the introductory Cilium Gateway API lab.
We highly recommend you do the Cilium Gateway API lab first, if you haven’t done it already.

In this one, you will learn about some additional specific use cases for Gateway API:

  • HTTP request & response header rewrite
  • HTTP redirect, rewrite and mirror
  • Cross-namespace routing
  • gRPC routing
  • East-West L7 routing with GAMMA

Isovalent Enterprise: Connectivity Visibility with Hubble Timescape

Investigate Kubernetes connectivity with Hubble CLI and Hubble Timescape. Build a service map, enrich flows with DNS and HTTP context, enforce trusted egress, and correlate historical drops with network policy changes.

Cilium for Virtual Machines with KubeVirt

In this lab, you will learn how to leverage KubeVirt to run virtual machines alongside containers in Kubernetes, while using Cilium for secure, scalable networking.

The lab will guide you through integrating VMs with Kubernetes' CNI via Cilium, implementing Zero Trust security policies, and enabling advanced networking features like live migration.

By the end, you'll understand how Cilium and KubeVirt provide seamless networking for both containerized and virtualized workloads in a cloud-native environment.

Isovalent Enterprise: Zero Trust Visibility

Creating the right Network Policies can be difficult. In this lab, you will use Hubble metrics to build a Network Policy Verdict dashboard in Grafana showing which flows need to be allowed in your policy approach.

Isovalent Enterprise: Multicast

Multicast support in Kubernetes has finally come to Cilium!

In this lab, you will discover how to set it up, take advantage of it, and observe multicast traffic in Kubernetes, using Cilium and Tetragon in Isovalent Enterprise.

Cilium: Host Firewall

Ever since its inception, Cilium has supported Kubernetes Network Policies to enforce traffic control to and from pods at L3/L4.

But Cilium Network Policies even go even further: by leveraging eBPF, it can provide greater visibility into packets and enforce traffic policies at L7 and can filter traffic based on criteria such as FQDN, protocol (such as kafka, grpc), etc…

Creating and manipulating these Network Policies is done declaratively using YAML manifests.

What if we could apply the Kubernetes Network Policy operating model to our hosts? Wouldn't it be nice to have a consistent security model across not just our pods, but also the hosts running the pods? Let's look at how the Cilium Host Firewall can achieve this.

In this lab, we will install SSH on the nodes of a Kind cluster, then create Cluster-wide Network Policies to regulate how the nodes can be accessed using SSH.

The Control Plane node will be used as a bastion to access the other nodes in the cluster.

Cilium IPAM

Kubernetes pods are transient resources with dynamic IP addresses. For this reason, IPAM is a central component of Kubernetes administration.

In tunneling mode, Kubernetes IPAM is usually configured to distribute IP addresses from a reserved private range, which is the most simple option.

In direct routing mode, where the aim is to integrate the Kubernetes platform into the underlying network fabric, IPAM can become more complex and require more advanced options.

In this lab, we will explore the various IPAM options provided by Cilium.

Golden Signals with Hubble and Grafana

One of the most important thing when running applications in an environment
like Kubernetes is to have good observability and deep insights.

However, for many organizations it can be challenging to update existing
applications to provide the observability you need. With Cilium, you can use
the Hubble Layer 7 visibility functionality to get Prometheus metrics for
your application without having to modify it at all.

In this lab you will learn how Cilium can provide metrics for an existing
application with and without tracing functionality, and how you can use
Grafana dashboards provided by Cilium to gain insight into how your
application is behaving.