Cilium is a powerful network policy and security enforcement solution that is designed to work with Kubernetes and other container orchestration platforms. Cilium network policy allows you to define rules that control how network traffic flows between Kubernetes pods and services or going outside of the cluster. These rules can…

Amazon MSK, standing for Amazon Managed Streaming for Apache Kafka, is a fully managed service that makes it easy to build and run applications that use Apache Kafka to process streaming data. However, connecting to MSK from outside of your Virtual Private Cloud (VPC) requires exposing your brokers to the…

Tcpdump is a powerful command-line packet analyzer tool for Unix/Linux operating systems and it uses the libpcap library to capture network traffic. Therefore it is very useful when troubleshooting network issues. Tcpdump in Kubernetes In the world of Kubernetes, there are many different ways to deploy and run applications, such as using containers…

MTU stands for Maximum Transmission Unit. It is a networking term that refers to the largest size of a data packet that can be transmitted in a particular network protocol. The MTU size is important because it determines the maximum size of the data packets that can be transmitted over…

ClusterMesh, a solution of multi-cluster from Cilium, can provides a bunch of benefits for cross-cluster communications or networking traffics, such as: 1. Pod IP routing across multiple Kubernetes clusters at native performance via tunneling or direct-routing without requiring any gateways or proxies. 2. Transparent service discovery with standard Kubernetes services…

CNI (Container Network Interface) is a fundamental framework for configuring and managing network resources and connectivities of containers, used by container runtimes. There are a bunch of CNI implementations used by Kubernetes and Cilium is one of them with popular usage. UPDATE: A terraform example of migrating steps in this…

AWS Elastic Kubernetes Service (EKS) does not support Kubernetes Network Policy with its VPC CNI plugin. Therefore, there are a bunch of options to for EKS to support Network Policy. Antrea is one of them I explored and tested in one of my EKS clusters. The most attractive point of…

Egress traffic is outbound network connections or requests from Pods in the Kubernetes cluster. By default, a Pod can send requests to any other Pods, even have access to internet. Though, it might have security concerns. Sometimes we just want a Pod only be able to access other Pods or…

Datadog is very popular in use for system observation and supports various data sources, like metrics, logs. This is much helpful for IT operations, security, and development teams to monitor their systems from different angles. In order to collect metrics of AWS resources into Datadog, an integration of Datadog and…