to secure access to and from external services, tradi�onal CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from applica�on containers to par�cular [h�ps://kubernetes.io/docs/concepts/overview/working-with- objects/labels/], Ingress [h�ps://kubernetes.io/docs/concepts/services- networking/ingress/], Service [h�ps://kubernetes.io/docs/concepts/services- networking/service/] 3m19s $ kubectl -n kube-system exec cilium-1c2cz -- cilium endpoint list ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source: ENFORCEMENT ENFORCEMENT 108

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular [https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/], Ingress [https://kubernetes.io/docs/concepts/services-networking/ingress/], Service [https://kubernetes.io/docs/concepts/services-networking/service/] 3m19s $ kubectl -n kube-system exec cilium-1c2cz -- cilium endpoint list ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source:key[=value]) IPv6 IPv4

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular [https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/], Ingress [https://kubernetes.io/docs/concepts/services-networking/ingress/], Service [https://kubernetes.io/docs/concepts/services-networking/service/] 3m19s $ kubectl -n kube-system exec cilium-1c2cz -- cilium endpoint list ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source:key[=value]) IPv6 IPv4

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular [https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/], Ingress [https://kubernetes.io/docs/concepts/services-networking/ingress/], Service [https://kubernetes.io/docs/concepts/services-networking/service/] Values=${infraID}-master-sg" | jq -r '.SecurityGroups[0].GroupId')" aws ec2 authorize-security-group-ingress --region "${aws_region}" \ --ip-permissions \ "IpProtocol=udp,FromPort=8472,ToPort=8472,UserIdGroupPairs=

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular [https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/], Ingress [https://kubernetes.io/docs/concepts/services-networking/ingress/], Service [https://kubernetes.io/docs/concepts/services-networking/service/] Values=${infraID}-master-sg" | jq -r '.SecurityGroups[0].GroupId')" aws ec2 authorize-security-group-ingress --region "${aws_region}" \ --ip-permissions \ "IpProtocol=udp,FromPort=8472,ToPort=8472,UserIdGroupPairs=

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular Values=${infraID}-master-sg" | jq -r '.SecurityGroups[0].GroupId')" aws ec2 authorize-security-group-ingress --region "${aws_region}" \ --ip-permissions \ "IpProtocol=udp,FromPort=8472,ToPort=8472,UserIdGroupPairs= [{GroupId=${worker_sg}},{GroupId=${master_sg}}]" \ --group-id "${worker_sg}" aws ec2 authorize-security-group-ingress --region "${aws_region}" \ --ip-permissions \ "IpProtocol=udp,FromPort=8472,ToPort=8472,UserIdGroupPairs=

to secure access to and from external services, traditional CIDR based security policies for both ingress and egress are supported. This allows to limit access to and from application containers to particular 3m19s $ kubectl -n kube-system exec cilium-1c2cz -- cilium endpoint list ENDPOINT POLICY (ingress) POLICY (egress) IDENTITY LABELS (source:key[=value]) IPv6 IPv4 namespace=default k8s:org=alliance Both ingress and egress policy enforcement is still disabled on all of these pods because no network policy has

pod 1 process kernel network stack raw PREROUTING mangle PREROUTING nat PREROUTING tc ingress conntrack filter FORWARD mangle POSTROUING nat POSTROUING tc egress veth woker node1 pod1 process kernel network stack tc ingress kernel network stack netfilter tc egress veth veth eth0 tc ingress tc egress redirect_peer redirect_neigh kernel network netfilter pod2 process kernel network stack tc ingress kernel network stack netfilter tc egress veth veth eth0 tc ingress tc egress redirect_peer redirect_neigh kernel network

connectivity between apps (allow for same customer, deny otherwise) ○ restrict connectivity for ingress (Envoy) and egress (public Internet with exceptions, e.g., SMTP) ○ allow connectivity to needed

release $ sudo tc qdisc add dev [device name] clsact $ sudo tc filter add dev [device name] ingress \ bpf da obj target/bpf/programs/limit/limit.elf \ sec tc_action/limit Rabbit(MQ) Protected