Lion Cipher Lab
Enforce Layer-7 network policy between pods with Cilium
- Cloud Security
- Advanced
- ~90 min
- Free · no account required
Why it matters
Plain Kubernetes NetworkPolicy is an L3/L4 control: it reasons about IP addresses, protocols and port numbers, and that is the entire vocabulary it has. It can say 'the frontend may open TCP 80 to the backend.' It physically cannot say 'the frontend may call GET /public but not POST /admin,' because by the time an HTTP method and path exist, the connection they travel on was already permitted or dropped — the policy engine never sees inside the request. That gap matters enormously in a microservice world, where a single service often exposes both a harmless read API and a devastating…
What you'll learn
- CiliumNetworkPolicy (the cilium.io/v2 CRD)
- Layer-7 HTTP-aware policy: filtering on method and path
- the difference between an L7 rejection (HTTP 403 at the proxy) and an L3/L4 drop (silent timeout)
- eBPF and the CNI's role as the enforcement point
- Cilium's per-direction default-deny model and endpointSelector scoping
- observing allowed and dropped verdicts with Hubble
- knowing that end-to-end TLS hides the L7 fields unless you terminate TLS at the proxy
- judging when L7 policy earns its Envoy cost versus L3/L4 plus a service mesh
Steps in this lab
- The gap: why 'allow port 80' allows every HTTP request there is
- Build a throwaway cluster with kind and install Cilium as the CNI
- Deploy the demo microservices and confirm they can talk
- Apply an L3/L4 policy — and watch it fail to stop the dangerous request
- Apply the L7 policy — and prove the 403-at-the-proxy behaviour
- Watch the verdicts with Hubble
- The model, the costs, and the judgment call