Demonstrates practical techniques for safely testing and deploying Cilium network policies in production Kubernetes clusters. Covers audit mode for observing policy impact without enforcement, default-deny toggles for gradual rollout, and the Isopolicy CLI tool for simulating policy changes against live or historical traffic
Table of contents
How do Cilium network policy operations and enforcement modes work?Test environment setupScenario 1: Applying the first default deny policySolution 1.a: Endpoint audit modeSolution 1.b: Policy default deny modeScenario 2: Making changes to the existing policiesSolution 2.a: L7 allow-allSolution 2.b: Introducing IsoPolicy for Network Policy simulationsSummary & Next StepsSort: