Network Segmentation at Scale: GitOps-Driven Multi-Tenant Isol...
summary
Demo shows a production pattern using Argo CD and Cilium Network Policies to enforce both orchestration and network isolation, starting with five hand-crafted tenants then scaling to 100+ tenants via Argo CD ApplicationSets that generate per-tenant projects, policies and workloads from Git. Out‑of‑band kubectl edits are auto‑reverted by Argo CD self‑healing, Hubble surfaces 403 denials for blocked L7 requests, and service‑account impersonation plus RBAC prevents tenant service accounts from creating or modifying Cilium policies. The setup works end‑to‑end in the demo.
AI-written summary · about
chapters (10)
- 0:00Introduction and setup
- 1:03Demonstrating security gaps
- 3:36Implementing network policies
- 5:02Enhancing with Cilium
- 7:38Orchestration isolation
- 10:51Refining Argo CD projects
- 14:02Scaling with ApplicationSets
- 17:55Observing with Hubble
- 19:54Identity-aware security
- 23:32Conclusion and summary
related talks
21mMulti-Tenant ArgoCD with security and isolation
25mPolicy-Based GitOps: How Policies Can Help Secure and Automate GitOps...
24mManaging Argo CD Multi-Tenancy Effectively
30mManage your kubernetes cluster in the GITOPS way !!
20mScale production grade K8s Multi-Cluster environments using GitOps
26mUnlocking the Power of Multi-Tenancy in ArgoCD: A Journey with Expedia..
32mGitOps, an Elegant Tool for Hybrid Cloud Kubernetes
23mScale GitOps With the Argo CD Agent and Open Cluster Management