Tag: Public Cloud
-
How to configure Istio’s Gateway Network Topology
Istio has a feature that allows you to configure it to recognize your gateway network topology correctly. -> https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies/ The reason you want to do this is that, when using the Istio ingress gateway as the entry point to your services, you want to determine the trusted client address from the x-forwarded-for HTTP header. Envoy…
-
How to configure minimum TLS version, elliptic curves and PQC for Istio
Today we will briefly talk about how to configure the minimum TLS version and elliptic curves Istio shall use. By default, Istio requires TLS 1.2 as the minimum version and uses Envoy’s default elliptic curves, X25519 and P-256. We can verify this by running the SSL Server Test from Qualys SSL Labs. -> https://www.ssllabs.com/ssltest/ But…
-
Cilium’s IPsec performance on Azure Kubernetes Service BYOCNI
After looking at Cilium’s transparent encryption performance for WireGuard and ztunnel on Azure Kubernetes Service BYOCNI, we now look at IPsec. -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-2/ -> https://www.danielstechblog.io/cilium-ztunnel-native-mtls-for-cilium-on-azure-kubernetes-service-byocni/ As in the tests before, the MTU has been left untouched. In other words, jumbo frames have not been used. Set up IPsec in Cilium Similar to the ztunnel encryption…
-
Cilium ztunnel – native mTLS for Cilium on Azure Kubernetes Service BYOCNI
At KubeCon Europe 2026, the Cilium project announced native mTLS support for Cilium via ztunnel. -> https://cilium.io/blog/2026/03/23/native-mtls-cilium/ Cilium’s ztunnel implementation is a fork of Istio’s ztunnel, reengineered to directly integrate it with the Cilium control plane and SPIRE as a certificate authority. Bringing ztunnel to Cilium is a joint effort by Isovalent and Microsoft. In…
-
Performance comparison Cilium native routing on Azure Kubernetes Service BYOCNI
As a follow-up on the series about Cilium native routing on Azure Kubernetes Service BYOCNI, we focus in today’s blog post on the performance comparison between the different configurations. -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-1/ -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-2/ -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-3/ BYOCNI – Cilium VXLAN encapsulation BYOCNI – Cilium VXLAN encapsulation + WireGuard encryption BYOCNI – Cilium native routing + Wire…
-
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 3
This is the third and final part of a three-part series about “An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI”. -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-1/ -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-2/ We will focus today on how to enable Cilium native routing with Azure Route Server and BGP on Azure Kubernetes Service BYOCNI. Azure Route Server Azure Route…