Lab

GitOps Platform Engineering with Cilium

Build a GitOps platform with Argo CD, Gitea, Kyverno, Gateway API, Cilium, and isopolicy CI.

Dive into the essentials of GitOps platform engineering for Kubernetes networking in this hands-on lab. You'll build a workflow that connects Argo CD, Gitea, Kyverno, Gateway API, Cilium, Timescape, and isopolicy CI so network changes move through Git, review, validation, and automated sync.

Beyond the basics, this lab highlights how platform teams can give application teams a safe self-service path for Cilium network policy and HTTPRoute changes. You'll see how pull requests, policy analysis, admission guardrails, and Argo CD reconciliation work together to catch mistakes before they reach production.

Finally, use Timescape to troubleshoot a real application-team incident by correlating flow history with policy changes. Through practical exercises, this lab shows how GitOps, Cilium, and observability create a platform where networking changes are auditable, recoverable, and ready for production workflows.

  • 🏗️ The Platform Foundation

    Explore the GitOps platform and verify all platform components are running

  • 🔥 Day One Without Guardrails

    Experience the coordination failures that happen when multiple teams share a cluster without guardrails

  • 🛡️ Policy Guardrails with Kyverno

    Write Kyverno ClusterPolicies to enforce Cilium Network Policy standards across all teams

  • 📁 GitOps Repository Structure

    Structure and push your application manifests to the Gitea repository for GitOps delivery

  • 🔄 Argo CD Applications and GitOps Pipelines

    Connect Argo CD to Gitea and create the Application that syncs manifests into the cluster

  • 🚪 Gateway API as Code

    Add Gateway API routing to the GitOps pipeline with HTTPRoutes and Gateways managed in Git, enforced by Kyverno

  • 🤖 Policy CI with isopolicy

    Gate network policy changes with automated isopolicy validation in Gitea Actions before any CNP reaches production

  • 🚀 The Application Team Experience

    Switch hats to the app team, push a policy change via Git and witness the GitOps + Kyverno feedback loop

  • 🥋 Exam: Ship a New App via GitOps

    Diagnose a rejected exposure attempt, then ship Cilium policy and Gateway API routing through the GitOps pipeline