Talks.

Your agent can call anywhere: egress containment with Cilium

An agent decides at runtime which API it is going to call. That is its usefulness and also its problem: from the network's point of view it is a workload whose destination cannot be predicted at deploy time — and the same goes for any workload that resolves its egress dynamically. Native NetworkPolicy reasons about IP addresses, and that model cannot express "this pod talks to these two APIs and nothing else": the IP behind a name changes, and the policy stops meaning anything. Cilium solves it by reasoning about identities and domain names. In this talk I build an egress perimeter for a workload like that, we watch it work in Hubble, and we look at what this approach might not solve.