--- title: Watching Zero Trust Happen: A Cilium + Hubble Demo on a... description: A hands-on walkthrough for setting up a local Kubernetes cluster using kind with Cilium as the CNI and kube-proxy replacement, plus Hubble for real-time... canonical: https://daily.dev/posts/watching-zero-trust-happen-a-cilium-hubble-demo-on-a-local-kind-cluster-ks54iynnz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Watching Zero Trust Happen: A Cilium + Hubble Demo on a Local kind Cluster | daily.dev og:description: A hands-on walkthrough for setting up a local Kubernetes cluster using kind with Cilium as the CNI and kube-proxy replacement, plus Hubble for real-time... og:url: https://daily.dev/posts/watching-zero-trust-happen-a-cilium-hubble-demo-on-a-local-kind-cluster-ks54iynnz og:image: https://api.daily.dev/og/posts/Ks54iYNnZ.png og:image:alt: Watching Zero Trust Happen: A Cilium + Hubble Demo on a Local kind Cluster og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Watching Zero Trust Happen: A Cilium + Hubble Demo on a Local kind Cluster **[Medium](https://daily.dev/sources/medium_js)** · 7 min read · 0 upvotes · 0 comments ## Summary A hands-on walkthrough for setting up a local Kubernetes cluster using kind with Cilium as the CNI and kube-proxy replacement, plus Hubble for real-time network observability. The demo deploys a frontend, backend, and rogue client to demonstrate zero-trust network policies in action. It covers disabling the default CNI, installing Cilium with Hubble enabled, applying a namespace-wide default-deny CiliumNetworkPolicy, and then layering scoped allow rules — showing live hubble observe output at each stage to make policy enforcement visible. Key gotchas like the k8sServiceHost configuration and the Cilium 1.16+ admission webhook behavior for empty ingress/egress lists are also addressed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does Cilium reject an empty ingress or egress list in a CiliumNetworkPolicy? As of Cilium 1.16 and later, the admission webhook rejects a truly empty list like ingress: [] with the error 'rule must have at least one of Ingress, IngressDeny, Egress, EgressDeny.' The workaround is to use a list containing a single empty rule object, ingress: [{}], which matches no traffic while still satisfying the webhook's requirement that a rule be present. _Track version-specific policy syntax gotchas like this one for Cilium on daily.dev before they break a deployment._ ### How do I make Cilium use its own kube-proxy replacement inside a kind cluster instead of kindnet? Set disableDefaultCNI: true and kubeProxyMode: none in the kind cluster config so no CNI is installed by default, leaving nodes in NotReady until Cilium is applied. Then install with cilium-cli using kubeProxyReplacement=true, and set k8sServiceHost to the kind control-plane container's Docker DNS name (not 127.0.0.1) so worker nodes can reach the API server. _Save configuration steps like these on daily.dev when setting up local Kubernetes networking labs._ ### How can I verify that a Kubernetes network policy is actually blocking traffic in real time? Run hubble observe against the namespace and watch live flow logs: denied traffic shows as DENIED and DROPPED verdicts, for example a rogue client's DNS lookups to CoreDNS being refused before any connection forms, while allowed traffic shows ALLOWED and FORWARDED through DNS resolution and TCP handshake completion. This gives flow-level visibility without sidecars or application instrumentation. _Developers debugging network policy enforcement can follow tooling deep dives like this on daily.dev._ ## Similar posts on daily.dev - [Multi AZ by Default, Local by Design, Cutting Cross Zone Traffic With Cilium](https://daily.dev/posts/multi-az-by-default-local-by-design-cutting-cross-zone-traffic-with-cilium-can44cqgu) · Isovalent · 1 upvotes · 0 comments - [Zero Trust with Cilium : Enforcing mTLS in Kubernetes](https://daily.dev/posts/zero-trust-with-cilium-enforcing-mtls-in-kubernetes-1gbrdwnxf) · Faun · 3 upvotes · 0 comments - [Kubernetes Networking Explained: From ClusterIP to Cilium Service Mesh](https://daily.dev/posts/kubernetes-networking-explained-from-clusterip-to-cilium-service-mesh-rhwqkcwdn) · freeCodeCamp · 5 upvotes · 1 comments - [Zero-Trust Developer Platforms with Cilium Network Policies](https://daily.dev/posts/zero-trust-developer-platforms-with-cilium-network-policies-qpoai8tmf) · cilium · 8 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#kubernetes](https://daily.dev/tags/kubernetes), [#cilium](https://daily.dev/tags/cilium) [View this post on daily.dev](https://daily.dev/posts/watching-zero-trust-happen-a-cilium-hubble-demo-on-a-local-kind-cluster-ks54iynnz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Watching Zero Trust Happen: A Cilium + Hubble Demo on a Local kind Cluster","url":"https://daily.dev/posts/watching-zero-trust-happen-a-cilium-hubble-demo-on-a-local-kind-cluster-ks54iynnz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/watching-zero-trust-happen-a-cilium-hubble-demo-on-a-local-kind-cluster-ks54iynnz"},"datePublished":"2026-07-23T19:33:40.875Z","dateModified":"2026-09-13T19:04:11.690Z","description":"A hands-on walkthrough for setting up a local Kubernetes cluster using kind with Cilium as the CNI and kube-proxy replacement, plus Hubble for real-time...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cfcee65342b3c5c21a097b6040348e91?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cfcee65342b3c5c21a097b6040348e91?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/watching-zero-trust-happen-a-cilium-hubble-demo-on-a-local-kind-cluster-ks54iynnz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,kubernetes,cilium","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Watching Zero Trust Happen: A Cilium + Hubble Demo on a Local kind Cluster"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/watching-zero-trust-happen-a-cilium-hubble-demo-on-a-local-kind-cluster-ks54iynnz#faq","mainEntity":[{"@type":"Question","name":"Why does Cilium reject an empty ingress or egress list in a CiliumNetworkPolicy?","acceptedAnswer":{"@type":"Answer","text":"As of Cilium 1.16 and later, the admission webhook rejects a truly empty list like ingress: [] with the error 'rule must have at least one of Ingress, IngressDeny, Egress, EgressDeny.' The workaround is to use a list containing a single empty rule object, ingress: [{}], which matches no traffic while still satisfying the webhook's requirement that a rule be present. Track version-specific policy syntax gotchas like this one for Cilium on daily.dev before they break a deployment."}},{"@type":"Question","name":"How do I make Cilium use its own kube-proxy replacement inside a kind cluster instead of kindnet?","acceptedAnswer":{"@type":"Answer","text":"Set disableDefaultCNI: true and kubeProxyMode: none in the kind cluster config so no CNI is installed by default, leaving nodes in NotReady until Cilium is applied. Then install with cilium-cli using kubeProxyReplacement=true, and set k8sServiceHost to the kind control-plane container's Docker DNS name (not 127.0.0.1) so worker nodes can reach the API server. Save configuration steps like these on daily.dev when setting up local Kubernetes networking labs."}},{"@type":"Question","name":"How can I verify that a Kubernetes network policy is actually blocking traffic in real time?","acceptedAnswer":{"@type":"Answer","text":"Run hubble observe against the namespace and watch live flow logs: denied traffic shows as DENIED and DROPPED verdicts, for example a rogue client's DNS lookups to CoreDNS being refused before any connection forms, while allowed traffic shows ALLOWED and FORWARDED through DNS resolution and TCP handshake completion. This gives flow-level visibility without sidecars or application instrumentation. Developers debugging network policy enforcement can follow tooling deep dives like this on daily.dev."}}]} ```