Lab

Isovalent Enterprise: Network Policies

Compose CNP and CCNP rules, diagnose verdicts, and refine policy with retained evidence.

Use Cilium 1.19.5 policy to compose namespaced and cluster-wide decisions, prove deny precedence and HTTP L7 behavior, and refine changes with Hubble, Timescape, and Isopolicy.

  • 🏛️ Inspect the multi-tenant environment

    Meet the tenants and the tools you will use to protect them.

  • 🌐 Establish baseline connectivity

    Prove same-tenant, cross-tenant, and external flows before applying Cilium Network Policies.

  • 🛡️ Apply tenant default deny with DNS

    Preserve same-tenant traffic and DNS while isolating tenant-a.

  • 🧩 Compose CNP and CCNP decisions

    Prove that a cluster-wide explicit deny overrides matching namespaced allows.

  • 🔍 Diagnose two policy denials

    Use Hubble reasons, policy attribution, and selectors to distinguish explicit deny from unmatched default deny.

  • 🧭 Refine a coarse CNP with Isopolicy

    Lint, tune, and simulate a broad policy with Isopolicy, then apply and verify a tighter boundary.

  • 🌐 Compose HTTP method and path policy

    Distinguish HTTP rejection from a datapath drop and expose an L4 widening mistake.

  • 🌍 Match cascaded AWS service subdomains

    Allow cascaded amazonaws.com service subdomains while excluding the resolvable apex.

  • 🥋 Repair a multi-scope API policy

    Diagnose the policy faults, complete two supplied templates, and prove the repaired behavior.