Lion Cipher Lab
See every pod-to-pod flow with Cilium Hubble (and catch a connection that shouldn't exist)
- Cloud Security
- Intermediate
- Free · no account required
Why it matters
When a segmentation control 'fails open,' nobody notices until an attacker walks sideways through your cluster. Hubble is how you actually SEE east-west (pod-to-pod) traffic in Kubernetes and read the verdict Cilium gave each connection — so you can debug why a policy broke an app, hunt for lateral movement after a compromise, and prove to an auditor that a control blocks what it claims to. But seeing is not stopping: this lab drills the difference by watching one forbidden flow flip from allowed to dropped the moment you add a wall. Knowing which tool is the microscope and which is the wall…
What you'll learn
- Cilium Hubble flow observability
- reading L3/L4/L7 flow verdicts (FORWARDED vs DROPPED)
- filtering flows with hubble observe (--from-pod, --to-pod, --verdict)
- spotting an unexpected pod-to-pod connection
- proving a Kubernetes NetworkPolicy actually blocks traffic
- telling observability apart from enforcement
Steps in this lab
- The vocabulary, in one breath (pod, CNI, eBPF, Hubble)
- Spin up a throwaway Kubernetes cluster with kind
- Install Cilium and turn Hubble on
- Deploy a frontend and a database pod
- Watch the forbidden flow — and see the FORWARDED verdict
- Apply a default-deny wall — then watch the same flow flip to DROPPED
- When to reach for Hubble, its honest limits, and clean up