Here is an example policy file that extends our original policy by limi�ng �efighter to making only a POST /v1/request- landing API call, but disallowing all other calls (including PUT /v1/exhaust- port). - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the exis�ng rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Status: Nodes: Minikube: Annotations:

is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: toPorts: - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the existing rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Status: Nodes: Minikube: Annotations: Kubectl

is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: toPorts: - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the existing rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Status: Nodes: Minikube: Annotations: Kubectl

is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: toPorts: - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the existing rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Events: and cilium CLI: $ kubectl -n kube-system

default/tiefighter:42690 -> default/deathstar- c74d84667-cx5kp:80 http-request FORWARDED (HTTP/1.1 POST http://deathstar.default.svc.cluster.local/v1/request-landing) May 4 13:23:40.502: default/tiefighter:42690 default/tiefighter:42690 <- default/deathstar- c74d84667-cx5kp:80 http-response FORWARDED (HTTP/1.1 200 0ms (POST http://deathstar.default.svc.cluster.local/v1/request-landing)) May 4 13:23:43.791: default/tiefighter:42742 is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion:

is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: toPorts: - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the existing rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Events: and cilium CLI: $ kubectl -n kube-system

default/tiefighter:42690 -> default/deathstar- c74d84667-cx5kp:80 http-request FORWARDED (HTTP/1.1 POST http://deathstar.default.svc.cluster.local/v1/request-landing) May 4 13:23:40.502: default/tiefighter:42690 default/tiefighter:42690 <- default/deathstar- c74d84667-cx5kp:80 http-response FORWARDED (HTTP/1.1 200 0ms (POST http://deathstar.default.svc.cluster.local/v1/request-landing)) May 4 13:23:43.791: default/tiefighter:42742 is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: