Kubernetes Networking Field Notes

Cilium is not just a CNI swap. It changes the cluster datapath, policy engine, observability surface, and sometimes kube-proxy ownership. Before treating it as production-ready, prove the network contract rather than stopping at Running pods. Define Ownership First Write down what owns each layer: cluster bootstrap -> installs the selected CNI once Cilium operator -> reconciles Cilium configuration and identities Cilium agents -> enforce datapath and policy on each node kube-proxy -> enabled, replaced, or intentionally absent platform team -> node routing, firewall, MTU, upgrades, and rollback app teams -> service labels, ports, and policy intent Do not let RKE2, Helm, GitOps, and manual manifests all believe they own CNI installation. One owner should install and upgrade the datapath. ...

Egress control is where platform security, application dependencies, DNS, and network operations collide. The goal is not simply to block outbound traffic. The goal is to make allowed outbound paths reviewable, observable, and recoverable when a dependency changes. Define The Egress Path For each cluster, document the path: pod -> CNI policy -> node routing -> NAT gateway or firewall -> proxy, if used -> external service Track ownership for: ...

NetworkPolicy is production access control. Roll it out like a platform change, not a formatting cleanup. The risk is not only blocking traffic. The risk is blocking traffic without knowing which dependency the workload actually needed. Start With Namespace Ownership Before applying default deny, confirm: namespace owner. workload owner. expected ingress sources. expected egress destinations. DNS dependency. metrics and log scrape paths. admission webhook or sidecar dependencies. emergency rollback path. If the namespace owner cannot name the required network paths, observe first and enforce later. ...