Cilium and eBPF Security

Enforcing network security in the Linux kernel with Cilium and eBPF: security identities, packet-path policy verdicts, and flow logs as evidence.

Workload Identity on Kubernetes: Policy Without CIDRs

The rule that lets the application reach its database names an identity, not an address. No IP. No CIDR. No route. No security group. Written that way, the rule holds the same on one node or a thousand, on-prem or across three clouds, and it does not break when a pod moves, because nothing in it ever said where anything was. In part 1 the same application connected to MySQL with no password, on one host. If part 1 was “the credential is not a string,” this is part 2: “the perimeter is not a subnet.” Same demo, same images, same page, same SQL. This time the application and the database live in different Kubernetes namespaces, and one new idea carries the whole piece: the network itself reads the identity. ...