Cilium in Practice: Building Data Sandboxes at Bloomberg
summary
Bloomberg builds isolated Jupyter research environments using Cilium as CNI with eBPF to route outbound flows through an Envoy proxy enforcing L7 Cilium policies. Cluster agents pull per-cluster TLS certs managed by Helm, policies default deny and allow only three sandbox S3 buckets via AWS AssumeRoleWithWebIdentity OIDC tokens and IAM session tags. Hubble provides visibility. Result: automated TLS termination, token-based restricted S3 writes, and blocked exfiltration that surfaces as 403s with negligible performance impact.
AI-written summary · about
chapters (14)
- 0:00Cilium at Bloomberg
- 1:06Cilium for my use case
- 3:11Data sandbox concept
- 5:41Network policies enforcement
- 7:05Layer 7 policies
- 8:49TLS termination
- 9:53Outgoing traffic flow
- 11:17Sandbox storage
- 14:51Implementation lessons
- 16:59Security policies
- 17:42Why Cilium outperforms alternatives
- 18:27Observability with Hubble
- 20:33Open source ecosystems
- 21:37Adopt Cilium
related talks
22mOne Project, Different Angles: How to Secure and Observe with Cilium
20mTackling Container Networking at Scale
01h 13mCilium Workshop
36mCilium: Welcome, Vision and Updates
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
32mBreaking Boundaries: Multi-cluster with Cilium cluster mesh
43mA Guided Tour of Cilium Service Mesh
31m10 Years of Cilium: Connecting, Securing, and Simplifying the Cloud Nat...