►
From YouTube: Hands-on Workshop: Network Policies - The Not-So-Hard Way - Raymond de Jong & Tracy Holmes
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Hands-on Workshop: Network Policies - The Not-So-Hard Way - Raymond de Jong & Tracy Holmes, Isovalent
Many people avoid networking wherever possible because they think it is too complex and don’t even get them started on policy. In this session, we will help overcome these fears for both app developers and operations teams with network policies the not so hard way. In four easy steps we will: Introduce the fundamentals of Cilium Network Policies and the basics of application-aware and Identity-based Security Discuss the default-allow and default-deny approaches and visualize the corresponding ingress and egress connections Use the Network Policy Editor to show how a Cilium Network Policy looks and what they do on a given Kubernetes cluster Walk through examples and demonstrate how application traffic can be observed with Hubble The audience will walk away with the ability to create network policies for their workloads so they can stop worrying and love the secure connections, and show how you can use the Network Policy Editor to apply new Cilium Network Policies for your workloads.
A
Our
goal
is
to
defeat
the
lunch
dip
and
talk
about
Network
policies,
The
Not,
So,
Hard
Way,
with
psyllium,
why
it's
different
and
how
you
can
effectively
secure
your
workloads
in
your
clusters
today
with
me,
is
Tracy
home
so
like
to
introduce
Tracy
she's
going
to
run
the
actual
lab
with
you
guys,
I'm
going
to
first
start
with
the
presentation.
My
name
is
Raymond
Dion
I'm
from
isof
valence,
I'm,
a
Solutions
architect
and
I'm
here
today
to
talk
about
Network
policies.
A
So
the
agenda
first,
we'll
talk
about
psyllium
and
ebpf
as
an
introduction
talk
about
security
and
observability.
What
feature
celium
has
for
you
to
secure
your
workloads
to
observe
your
workloads,
then
a
little
bit
about
strategies
for
Designing
and
working
with
network
policies,
after
which
we
sure
have
a
short
demo
using
Hubble
UI
as
well,
after
which
we
will
dive
into
the
lab
with
Tracy,
and
we
want
you
to
also
do
the
lab.
Alongside
with
us
and
for
that
purpose.
A
I
would
like
you
to
ask
already
to
go
to
isofelion.com
forward,
slash
labs
and
then
start
the
getting
started
with
psyllium
OSS
labs.
It
takes
a
few
minutes
for
the
labs
to
be
actually
be
created.
It's
an
actual
lab
running
on
kinds
based
clusters.
For
that
to
be
proficient
with
a
group,
it
makes
sense
for
people
to
already
start
it
just
wait
to
continue
before
Tracy
will
start
to
live
with
you.
A
Cool
silium
and
eppf
introduction,
so
we're
from
ISO
Finance,
We're
The
Originators
from
psyllium.
We
invented
psyllium
and
donated
it
to
the
community
and
celium
is
widely
used
amongst
multiple
different
environments
for
different
use.
Cases
among
security,
psyllium
is
based
on
ebpf
and
ebpf
is
a
technology.
A
What
we
like
to
say
is
that
it's
a
technology
similar
to
JavaScript
to
the
browser,
psyllium
or
eppf,
is
to
the
kernel,
and
it
makes
the
kernel
programmable
in
a
very
efficient
way
without
actually
changing
the
kernel
and
it's
very
powerful
because
it
can
run
on
kernel
events,
so
anything
a
process
opening
a
socket
or
a
network
device
sending
a
packet.
Those
are
currently
events
where
we
can
attach
evpf
programs
on
and
that's
very
powerful,
because
we
can
do
things
with
that.
A
It
takes
care
of
identities
instead
of
ips
has
a
lot
of
functionalities
and
features
of
which
of
networking
observabilities
with
Hubble,
which
we'll
show
and
demonstrate
today
as
well,
and
we've
introduced
a
service
mesh
solution
which
is
a
sidecar,
less
implementation,
powered
with
ebpf
to
accelerate
the
surface
mesh
capabilities
to
do
layer,
7
pathway,
routing
providing
Ingress
out
of
out
of
the
box
without
using
a
sidecar
which
three
to
four
times
improves
latency
and
performance
and
obviously
removes
resources.
You
may
need
for
running
sidecars
in
your
clusters.
A
A
Think
about
tier
front-ends
application
nginx
that
you,
you
unique
set
of
labels
will
result
in
an
identity
and
psyllium
uses
this
identity
to
attach
this
identity
using
ebpf
to
the
actual
IP
packet
and
we're
able
to
also
observe
and
identify
indent
that
identity,
for
example,
on
the
destination
so
front
end
reaching
out
to
a
back
end
means
that
the
front
end
gets
that
identity
attached
and
the
back
end
will
be
able
to
inspect
that
identity
when
to
get
traffic
goes
inbound
and
depending
on
the
network
policies
you
configure.
It
allows
organize
that
traffic.
A
Furthermore,
psyllium
provides
API
aware
authorization,
and
what
that
means
is
that
not
only
layer,
3
on
IPS
or
lay
ends
or
layer
4
on
ports.
We
also
provide
layer,
7
rules
and
capabilities
to
be
able
to
filter
HTTP
requests
on
specific
calls
methods
on
specific
Buffs,
and
this
is
an
example
of
a
psyllium
Network
policy,
where
we
have
a
HTTP
aware
rule
for
a
namespace
demo,
where
we
apply
this
rule
to
an
applications
called
server,
match
labels
app
equals
server
and
then
have
a
rule
Ingress
from
endpoints
clients
to
Port
80
and
then
notice.
A
A
A
Furthermore,
what's
very
powerful
is
the
psyllium
Network
policies
which
are
DNS
aware,
which
means
that,
for
example,
you're
running
storage,
workloads
on
S3
buckets,
as
you
may
know,
IPS
of
those
buckets
change
all
the
time.
So
securing
those
resources
is
hard
to
track
using
fully
qualified
domain
names.
However,
you
can
filter
traffic
to
a
specific
bucket,
and
that
means
that
using
DNS
aware
serial
Network
policies,
you
can
secure
access
to
a
given
fully
qualified
domain
name.
A
A
Senior
Network
policies
are
very
powerful,
but
without
the
right
observability
tools,
you're
still
lost,
applying
a
specific
configuration
of
security
on
your
workloads.
Cdm.
Sorry,
how
about
you?
How
about
is
our
observability
solution
on
top
of
psyllium
and
we
provide
a
UI
which
shows
a
surface
dependency
map
allows
you
to
see
the
flows
between
surfaces
on
protocol
level
depending
on
the
policies
you
set.
You
can
even
see
flows
for
layer,
7
rules
as
well
for
more
advanced
use,
cases,
troubleshooting
or
or
inspection.
A
We
also
support
a
CLI
which
allows
you
to
also
do
extensive
filtering
and
also
be
able
to
allow
output
to
Json
and
the
Hubble
metrics
components.
Everything
related
to
getting
metrics
out
of
Cillian
and
Hubble
and
Export
them
through
Prometheus
to
gravana,
for
example,
or
in
advanced
use
cases
also
to
sim
platforms
to
get
alerts,
for
example
in
Splunk,
on
security
incidents.
A
This
is
how
the
CLI
looks
like
I'm
not
going
to
talk
a
lot
about
this,
because
you
also
discovered
this
in
the
lab.
But
what
you
will
see
and
what's
important
to
notice,
is
that
we're
able
to
identify
the
HTTP
course
the
fully
qualified
domain
names
being
accessed
and
also
the
identities
being
attached
to
those
workloads.
A
This
is
an
example
of
Hubble
metrics.
If
we
have
time
today,
I've
also
an
example
of
policy
verdict,
metrics
so
using
rafana,
we're
also
able
to
track
policy
verdicts
things
like
allows
or
denied
which
should
match
your
policies
where
you
can
see
how
many
policies
are
actually
matching
and
also
what
kind
of
domains
are
being
reached
out.
A
A
If
you
deploy
a
deny
all
policy,
it's
most
likely
to
become
very
difficult
and
hard
to
for
each
independent
service
and
application
to
introduce
a
cilium
Network
policy
and
to
troubleshoot
that
you
also
need
to
keep
them
up
to
date.
You
need
to
know
when
an
application
changes
what
is
actually
changed
and
and
what
you
need
to
do
to
change
your
cilium
Network
policy,
and
how
do
you
prove
that
and
what
are
the
risks?
A
So
our
goal
of
today
is
also
to
talk
a
bit
more
about
some
mechanisms
to
understand
or
approach
this
Challenge
and
to
be
effectively
secure.
Workloads
and
I
want
to
talk
about
four
risks
of
risk
exposure,
obviously
from
the
internet
when
you're
exposing
Services,
that's
a
huge
risk
from
internal
networks.
If
you
just
expose
from
any
destination
that
can
be
a
risk,
people
accessing
data
which
they
are
not
allowed
to.
A
If
we
look
at
the
intra
cluster
or
between
cluster,
we
have
lateral
movement,
risk
or
egress
risk
for
workloads,
reaching
resources
in
external
network,
for
example
a
physical
database
and
obviously
things
like
reaching
back
to
internet
as
well.
You
want
to
avoid
people
being
able
to
openly
open
a
reverse
shelf,
for
example,
so
the
goal
is
to
reduce
you
unused
access,
which
creates
exposure
without
being
required
for
the
application
to
work.
A
A
A
A
So
with
that
I'm
going
to
move
to
a
short
demo
as
an
introduction
to
the
actual
lab.
So
the
overview
is
that
we
have
deployed
a
namespace
with
a
starting
Network
policy
which
allows
traffic
from
that
namespace
and
I'm
slowly,
going
to
use
Hubble
or
I'm
going
to
use
Hubble
to
slowly
introduce
more
specific
psyllium
Network
policies
to
secure
that
namespace
and
eventually
remove
the
allow
all
rule
to
have
that
specific
policy.
A
B
A
A
So
this
is
a
simple
example.
We
see
we've
deployed
this
namespace
called
my
app.
We
have
a
simple
client
server
application
running
and
we
can
see
traffic
from
the
client
to
the
server
on
Port
80,
most
likely
HTTP,
but
we
don't
see
it
yet
and
TCP
traffic
and
we
see
that
the
client
is
also
reaching
out
to
some
kind
of
destinations
outside
the
cluster,
perhaps
even
on
the
internet.
So
we
want
to
know
more
looking
on
the
flows,
the
live
flows.
We
can
see
it's
actually
public
IPS.
So
we
need
to
investigate
that
a
bit.
A
A
So
for
starters,
we
want
to
see
the
external
axis.
So
what
I
wanted
to
introduce
is
that
I'm
going
to
introduce
a
cilium
Network
policy
which
is
going
to
inspect
that's
DNS
traffic
from
that
client.
So
what
I
do
I
select
all
endpoints
using
this
and
then
specify
egress
to
allow
access
to
cube
system
to
Port
53,
but
I
also
specifically
have
a
rules
section
which
specifically
matches
for
DNS
and
using
this
wild
card
I'm
able
to
allow
DNS
requests,
but
I'll
also
see
the
fqdns
being
reached
out
to
so.
A
A
A
Note
this
Ingress
part
using
this
I'll
deny
everything
Ingress
for
the
specific
endpoint
and
an
egress
I
allow
the
server
to
sorry
allow
egress
connectivity
to
the
server
on
Port,
80
and
I
also
need
obviously
to
allow
Cube,
API
access
and
now
I
can
actually
add
the
two
follow
qualified
domain
names
piece
where
I
only
allow
these
two
domains
on
board.
Four
for
three.
A
So
again,
this
won't
change
anything
here
and
now.
I've
applied
a
client
rule,
a
server
rule,
a
DNS
rule,
which
should
mean
that
I
also
have
secured
all
workloads.
So
what
I
can
now
do
is
remove.
The
two
broadly
specified
allow
all
rule
which
I
applied
for
the
application
to
function
and
if
I
did
things
correctly,
I
should
not
see
any
drops,
and
this
means
that
now
the
client's
application
is
working,
the
surf
application
is
working
and
it
is
allowed
to
access
external
resources.
But
let's
say
we
have
another
application
being
introduced.
A
So
let
me
quickly
go
through
this
and
then
so,
let's
say:
there's
another
namespace,
another
client
application
wanting
to
reach
out
to
the
server
application
and
it's
being
introduced,
but
we
can
now
see
this
another
app
tries
to
reach
to
the
server,
but
it's
not
able
to
reach,
we
see
drops
and
we
can
click
on
Hubble
UI
to
zoom.
In
on
this
on
other
app
workloads,
and
you
see
drops
and
forward,
you
may
wonder:
why
is
that?
Well,
it's
because
the
another
app
doesn't
have
any
policies
applied
to
it.
A
A
A
A
A
Okay,
so
depth
concludes
the
demo.
A
way
for
securing
your
workloads
and
from
here
I
will
hand
over
to
Tracy
to
go
through
the
lab
with
you.
So
you
get
more
hands-on
experience
yourself
with
a
Star
Wars
based
example,
secure
and
get
workload
you
see
here,
you
go!
Thank
you.
So
if
you
haven't
done
that
already
go
to
isovalent.com
forward,
slash
labs
to
start
the
getting
started
on
OSS
lab,
we
also
have
Duffy.
If
you
have
an
issue,
Duffy's
helped
me
to
help
as
well.
C
C
All
right
has
anyone
here
not
ever
touched.
Psyllium
like
raise
your
hand.
Oh,
this
is
going
to
be
good.
Okay.
Has
anyone
in
here
never
used
instruct
before
okay,
so
first
things,
first
Ray
told
you
all
about
the
URL
when
we
first
started,
if
you
hit
launch
when
he
first
started,
talking
go
back
out
and
go
back
in
what
instruct
will
do
is
if,
when
you
get
to
a
certain
time
limit,
it
will
kick
you
out
and
I.
Don't
want
that
to
happen
to
you
all,
while
you're
in
the
middle
of
the
lab.
C
C
C
I
will
read
the
majority
of
this
just
in
case
I.
Don't
know
if
English
is
everyone's
first
language.
So
therefore
you,
those
of
you
that
are
watching-
hopefully
you
can
understand
me.
The
other
thing
is
I,
am
a
fan
of
typing
things
out.
So,
if
you've
never
used
instruct
before,
when
we
get
to
the
first
page
I'm
going
to
show
you
something
to
make
sure
you
don't
miss
any
of
the
commands,
that's
that
are
on
the
right
side
of
the
page,
so
ensuring
Security
on
kubernetes.
C
How
do
you
enforce
policies,
troubleshoot
the
network
and
stay
secure
with
minimal
effort?
A
new
approach
is
needed.
You
get
to
talk
about
silly
in
the
day,
I'm
not
going
to
go
through
this.
However,
Ray
just
told
you
all
about
this
that
would
be
redundant.
You
are
free
to
review
that,
while
my
environment
is
creating
because
that's
going
to
take
about
a
minute
or
two.
C
C
C
There
we
go
all
right
so
start,
sorry
about
that.
Thank
you.
All
for
being
patient
I
didn't
have
any
jokes
ready,
I
apologize
so
for
those
of
you
that
never
use
instruct.
If
you
look
on
the
right
side,
where
you
see
the
kind
cluster
you'll
notice,
there
are
drop
down
arrows
for
everything.
If
you
want
to
work
ahead.
Absolutely
fine,
however,
make
sure
that
you
scroll
down,
because
some
of
the
text
will
hide
things
that
you
need
to
expand
before
you
can
move
on,
got
it.
C
C
Right
so
in
the
notes
section
you
can
see
that
the
cluster
consists
of
three
nodes:
one
control,
plane,
node
and
that's
running
the
case,
control
plane
and
two
worker
nodes
that
will
use
to
deploy
the
applications
in
the
networking
section
in
the
config
file.
The
default
cn9
has
been
disabled,
so
the
cluster
won't
have
any
pod
Network
when
it
starts.
Instead,
psyllium
is
being
deployed
to
the
cluster
to
provide
this
functionality,
so
psyllium
will
be
your
cni.
So,
let's
see
if
the
kind
cluster
is
ready.
C
C
Control
V
does
work
in
this
for
pasting.
You
can
also
just
copy
the
command.
Whenever
you
see
the
code,
the
copy
button
should
pop
up.
So
you
can
copy
it
that
way
if
you'd,
like
all
right,
so
you
see
all
three
of
the
nodes
appear.
So
you
see
those
on
the
screen
all
are
marked,
not
ready.
That's
normal.
The
cni
is
disabled
and
after
this
page
we're
going
to
install
a
psyllium.
So
if
you
don't
see
all
the
nodes,
they
might
still
be
joining
the
cluster
and
hey.
C
All
right,
so
what
we'll
be
using
if
you've,
ever
if
you've,
never
worked
through
one
of
our
getting
started
guides
in
the
docs?
There
are
a
couple
of
ways
to
get
to
this
point:
there's
actually
a
brew
command,
install
psyllium
or
at
least
get
the
agent
there
or
also
like
a
curl
command.
So
that's
what's
already
been
done
in
the
background
after
that,
step
is
where
we're
at
so
Salem
CLI
tool
is
provided
to
install
and
check
the
status
of
psyllium
in
the
cluster,
so
we
can
know
what's
going
on,
but
it'll
also.
C
C
C
C
C
C
C
If
you
don't
already
know
we're
fans
of
Star
Wars
here
at
night,
so
everything
going
forward
if
you're
a
Trekkie
I
apologize
in
advance,
so
to
learn
how
to
use
and
enforce
policies
with
psyllium.
We
have
prepared
a
demo
example:
we're
gonna
have
three
microservice
applications.
That's
going
to
be
the
death
star,
TIE
fighter
and
X-Wing
Death
Star
service
is.
C
C
It's
just
like
your
house.
You
don't
want
people
going
in
and
out
of
your
house
that
don't
that
should
navigate
right.
It's
basically
what
we're
doing
just
the
Star
Wars
version
all
right.
So
let's
check
to
make
sure
that
all
the
components
have
been
properly
deployed.
Let
me
move
this
over,
so
you
all
can
see
some
of
this.
There
we
go.
It
may
take
a
few
seconds
to
display
the
results.
You
all
are
very
patient
and
have
been
so
I.
C
Don't
think,
that's
going
to
be
an
issue
all
right,
so
Loom
successfully
rolled
out,
let's
deploy
the
demo
app
so
you'll
know,
which
is
what
is
what,
because
of
the
labels.
So
the
Death
Star
is
going
to
be
the
Empire
org
and
it's
going
to
be
just
our
class,
the
Imperial
Tie
fighters,
also
in
the
same
org.
So
it's
an
Empire
organization
and
it's
going
to
be
a
different
class,
it's
TIE
fighter
and
then
the
X-Wing
is
the
alliance
organization
and
the
class,
of
course,
is
X-Wing.
C
C
C
A
bit
of
a
copy,
it
works.
Well
that
was
just
rude
there.
We
go
all
right.
So
at
this
point
it's
already
saying
running,
but
each
bottle
go
through
several
States
until
it
reaches
running
at
the
point.
That
pot
is
ready.
So
let's
try
it
again.
Well,
if
you
need
to
try
it
again
until
you
see
that
everything
has
a
running
status,
each
bottle
also
be
represented
represented
in
psyllium
as
an
endpoint.
C
So
we
want
to
see
a
list
of
all
the
endpoints
that
are
managed
by
psyllium,
the
psyllium,
endpoint
or
sep
cep
resource
can
also
be
used.
I
will
tell
you
now
I
try
to
manually
type
in
and
it
did
not
work
earlier,
so
you
might
want
to
copy
and
paste
this
one
and
I
promise
I
actually
typed.
It
correctly.
B
A
C
A
Before
you
do
that
notice
the
identities
as
well
right,
so
you
can
see
the
Death
Star
have
similar
labels,
because
it's
two
pots,
so
they
have
the
same
identity
being
allocated
to
the
Death
Star.
So
that's
almost
a
unique
identity
for
similar
workloads.
So
with
this
command,
you
can
actually
point
and
troubleshoot
this.
C
All
right,
so,
let's
talk
about
death,
star
access
from
the
perspective
of
the
Death
Star
service,
only
the
ships
with
the
label
org
equals
Empire
or
anything.
That's
an
Empire
org
are
allowed
to
connect
and
request
a
landing,
but
we
don't
have
any
rules
in
Forest
so
like
what
will
happen,
if
not
only
the
Tie
Fighter,
but
also
the
X-Wing
request
landing.
C
C
Ship
landed
all
right,
so
the
command
above
get
lets
us
get
a
shell
on
the
Tie
Fighter
pod
and
run
an
HTTP
post
request
to
the
Death
Star
service
to
request
landing.
The
command
should
work
because
the
Tie,
Fighter
and
death
star
are
all
on
the
same
side
of
you
know
the
war
also
known
as
the
bad
guys,
which
I
hate
because
I'm
a
Boba
Fett
person,
but
anyway
now
test.
If
we
can
land
the
X-Wing
the
good
guys,
what
do
you
all
think
is
going
to
happen?
C
C
All
right,
so,
let's
here's
a
brief
blurb
about
identities
in
Cloud
native
IP
addresses
are
no
longer
relevant
for
cloud
native
workloads,
because
security
policies
need
something
else
they
just
do.
Selling
provides.
This
cylinder
uses
the
labels
assigned
to
the
pots
to
define
the
security
policies,
we're
going
to
start
with
a
basic
policy
restricting
the
Death
Star
Landing
requests
to
only
the
ships
that
have
the
label
or
Gables
Empire.
This
should
block,
or
this
blocks
any
ships
without
the
label
to
even
connect
to
the
Death
Star
service.
C
It's
a
simple
policy
that
well
I'm,
not
even
say
simple
policy.
It's
a
policy
that
filters
only
on
network
layer,
three,
so
that's
the
IP
protocol
and
network
layer
4,
which
is
a
TCP
protocol,
so
it's
often
referred
to
as
an
l304
network
security
policy,
and
so
this
is
what
it
looks
like.
It
has
a
graphic.
C
C
Let's
think
about
what
that
looks
like
or
should
look
like,
I
should
say:
I'm
going
to
expand
this
just
a
little
bit
come
on
Mouse
you
like
me
today,
right
there
we
go
so
we
need
to
match
on
Empire
ships
only
so
that
label
is
what
we
need
to
match
on
and
that's
what
that
would
look
like
match
labels
or
Empire
class
Death
Star.
We
also
have
to
make
sure
that
Ingress
from
the
endpoints
with
the
label
Empire
are
also
allowed
to
Port
80
for
protocol
TCP.
C
So
while
this
example
is
relatively
simple,
operators
sometimes
find
it
difficult
to
understand
and
to
build
Network
policies
and
psyllium
has
a
solution
for
this.
So
if
you
look
at
the
top,
where
you
see
terminal
right
next
to
that,
you
will
see
the
network
policy
editor,
what
I
will
say
is
if
you
learn
something
that
has
a
size,
a
MacBook,
Air
size
screen.
You
are
going
to
need
to
collapse
right
here,
you're
going
to
use
that
to
collapse,
so
you
can
actually
see
the
visualization,
or
else
it
won't
show
up.
C
So
you
can
all
click
on
that,
while
I'm
reading
through
this
so
click
on
the
to
see
a
visual
and
interactive
representation
of
your
policy
and
change
some
of
the
values.
If
you
want
to
play
around
and
better
understand
what
the
policy
is
doing
and
I'm
going
to
be
completely
honest
with
you,
networking
has
never
been
my
forte
I
used
to
cry
for
Cisco
stuff,
like
it
just
hasn't
break
fix
is
my
thing.
C
The
one
thing
I
did
like
when
I
started,
using
psyllium
or
starting
learning
psyllium,
because
honestly
I'm
still
learning
is
this
editor
that
you
all
are
looking
at,
because
it
was
easier
for
me
to
follow
along
with
what
everything
was
going
on.
Some
people
are
visual
and
I
just
happen
to
be
one
of
those
people.
C
So
the
central
part
of
the
diagram
represents
the
network
policy
selector
and
then
each
side
will
show
respectively,
which
Ingress
and
egress
are
allowed
for
the
workload.
So
you
basically
want
to
verify
that
your
current
selector,
which
are
the
Oregon's
Empire
class,
equals
Death
Star,
are
only
allowed
English
track
of
it
from
pods
labeled
as
org
equals
Empire,
and
that's
what
that
would
look
like.
C
So
you'll
get
this
most
times
whenever
you
get
on
here,
but
this
is
what
this
looks
like
I'm,
not
sure
you
would
want
to
do,
try
to
do
it
from
a
mobile
device,
but
outside
of
that,
it's
very,
very
helpful,
and
whenever
you
have
the
policy
you
want,
you
can
actually
download
it
or
just
copy
and
paste
it
into
your
Yamaha
all
right.
So
this
is
what
it
looks
like
on
the
tutorial
side.
It's
basically
the
same
thing:
I
just
showed
you.
It
just
doesn't
have
anything
preloaded.
C
And
that's
that
all
right,
so
let's
enforce
the
policy
and
we're
going
to
do
that
actually
using
the
terminal.
So
you
might
want
to
go
back
to
the
terminal
tab
and
we
can
apply
the
pre-configured
network
policy
with
the
values
that
we
just
talked
about
for
the
demo
system.
So
let's
copy
and
paste
that.
C
Which
she'll
still,
which
should
still
work
ship,
has
landed?
Now,
if
you
try
to
request
a
lending
with
your
X-Wing,
however,
you
should
see
that
it's
going
to
hang
like
nothing
at
all
should
happen
at
this
point
and
we
still
got
ships
Landing.
That
means
I,
probably
copied
and
pasted
something
incorrectly.
C
C
So
we've
blocked
the
access
to
the
Death
Star
from
an
X-Wing.
So,
let's
see
if
we
can
make
it
a
bit
more
fine-grained
those
of
you
that
work
in
government
separation
of
duties,
that's
basically
what
we're
about
to
do
or
any
other
place
somewhere
all
right.
So
it
was
sufficient
to
give
either
the
Tie
Fighter
X-Wing
full
access
to
death,
star's,
API
or
no
access
at
all.
But
are
you
absolutely
sure
that
you
can
trust
all
of
the
TIE
fighter,
pilots
of
the
entire
Empire
you're?
Not
because
you
don't
know
all
of
them.
C
C
C
All
right
so
think
about
this.
The
Death
Star
service
exposes
some
maintenance
apis,
which
should
not
be
called
by
random
Empire
ships
to
see
why
those
apis
are
sensitive,
we're
going
to
run
this
Cube
cuddle.
Yes,
cuddle,
say
it
again:
we're
going
to
run
this
cue
cuddle,
don't
shake
your
head
at
me!
Tuffy
command.
C
And
the
very
first
thing
you
see
is:
there's
a
panic,
because
the
Death
Star
exploded.
This
is
why
something
should
not
be
touched
by
everyone
all
right.
So
this
is
an
illustrative
example
and
yeah
it's
kind
of
dramatic,
but
unauthorized
access
such
as
a
book
can
have
adverse
security
repercussions.
Things
can
blow
up.
C
C
C
And
now
you
see,
access
is
denied,
which
is
what
we
wanted
so
with
L7
security
policies,
we're
able
to
restrict
the
access
only
to
the
required
API
resources
on
Deathstar
and
that
may
we
that
way,
we've
implemented
at
least
privileged
security
approach
for
the
communication
between
the
microservices
and
I
think
we're
about
to
have
another
quiz.
Are
we
I.
B
C
C
You
get
a
gold
star
thanks
so
much.
Let's
move
on
to
the
next
part,
we're
almost
through
actually
I
think
we
are
through,
so
we
saved
the
Death
Star
and
we
made
the
Empire
a
safe
place
and
I
think
you
know
what
we
all
deserve:
a
gold
star
for
that
and
some
good
coffee.
So,
let's
let
me
hit
this
because
I
want
to
show
you
something.
C
Our
slack
is
huge,
but
everyone
in
there
is
exceptionally
helpful,
especially
to
beginners
I
still
ask
beginner
questions
all
the
time,
but
the
other
thing
is:
if
you
want
to
contribute,
if
you
want
to
see
the
documentation
or
if
you
want
to
know
how
to
install
on
K
like
k3s,
for
example
or
I
like
I
use,
Rancher
desktop,
it
also
has
instructions
to
do
that.
Also.
So
please
go
check
it
out
and
if
you
have
any
questions,
you
are
free
to
tweet
me
and
I'm,
going
to
let
Ray
come
back
up.
Thank.
C
A
And
as
a
bonus
and
anyone
completing
the
challenge,
we're
working
on
some
batches
to
correctly
digital
badges,
so
as
soon
they
become
available,
you
will
award
that
batch
for
this
lab
as
well,
but
be
patient
with
us.
We
need
some
work
to
do
there
to
make
it
work.
So,
yeah.
Thank
you,
Tracy.
Thank
you
for
running
the
lab.
I
hope
you
all
liked
it.
Please
provide
feedback
to
us.
If
you
want
to
know
more,
there
are
I
think
already
10
Labs.
We
provide
both
open
source
and
Enterprise
Labs
on
different
topics.
A
A
Not
always
fine,
so
besides
slack,
we
have
on
this
conference
two
booths.
We
have
a
psyllium
Booth,
we
have
an
ISO,
Valen
Booth
feel
free
to
to
visit
us.
If
you
want
to
know
more
about
ebpf,
we
provide
the
cap,
the
option
or
the
opportunity.
I
would
say
to
get
the
what
is
ebpf
book
signed
by
Liz
and
we
also
have
Natalya,
who
has
the
security
Advanced
ebpf
book.
A
So
if
you
want
to
know
really
more
about
that
technology,
how
it
actually
work
I
recommend
to
visit
it
as
as
us
at
the
booth
and
even
get
it
signed
by
Liz
for
Enterprise
Solutions
go
to
isovania.com
and
to
know
more
about
that,
and
that
concludes
this
session.
Thank
you,
Tracy.
Thank
you.
Duffy
for
helping
out
I
hope
you
liked
it
enjoy
kubecon
and
thanks
for
joining.
A
A
A
So
basically
the
top
section
allows
you
to
filter
either
by
selecting
components
and
services
or
entering
a
filter.
You
can
filter
on
vertex
drop
forward
and
such
the
top
section
shows
life
flows
and
if
you
click
on
specific
surface,
it
will
focus
the
view
for
that
given
surface
and
it
will
focus
all
the
flows
as
well.
Ingress
and
egress
from
that
given
service.
Does
that
help
good?
Okay?
Another
question.