4 docs tagged with "cilium"

Reusable Kustomize component that drops a baseline `NetworkPolicy` into every app's namespace — default-deny ingress + egress, with explicit allow-rules for what the app actually needs to talk to.

eBPF-based CNI providing pod networking, kube-proxy replacement, network policy, WireGuard node-to-node encryption, L2 announcements for LoadBalancer IPs, and Hubble flow visibility.

How the homelab layers Kyverno admission policies, Policy Reporter visibility, Tetragon eBPF runtime observability, and Cilium-enforced network policy into one defense-in-depth story — what each layer catches, what is enforced versus audited, and where the deliberate gaps are.

End-to-end walkthrough of the homelab's ingress path — how a browser hitting immich.web.kueber.eu resolves DNS, lands on the Hetzner edge, crosses the NetBird mesh with PROXY protocol v2, terminates TLS on the production Envoy Gateway, and reaches the pod through Cilium.