What is our primary use case?
I have been using Isovalent for a very short duration; last year, mostly about 10 months ago, I was given a task to create a product called Tezz, which is an observability platform utilizing certain Kubernetes microservices, and to meet the standard of security, I explored tools for Kubernetes microservices hardening, leading me to Isovalent, where I took courses to understand it better. Isovalent, especially the Cilium tool, is very good as it provides capabilities to harden microservices not just based on Layer 3 and Layer 4.
In today's landscape, where security is crucial, we need to restrict communication between pods within a cluster, as this design is typically challenging due to the ephemeral nature of pod IPs and ports, and Cilium addresses this by allowing tagging, which permits easier restrictions based on front-end and back-end pod interactions.
While I am not currently using Isovalent, we have used it in our past project mainly to harden the microservices, specifically referencing our TICK stack, which comprises Telegraf, InfluxDB, and Grafana, where I was the End-to-end Architect tasked with securing the microservices. In this project, I evaluated various tools for hardening, and Isovalent emerged as essential with Cilium, which is a CNI for Kubernetes, allowing us to write YAML policies injecting into Helm charts for the TICK stack, enabling restricted communication between the pods in the cluster while hardening the entire product.
When writing those policies and restricting communications between the pods, we faced challenges as the team was unfamiliar with the new tool and initially used different CNIs, with the major challenge being how to implement this CNI and redeploy our entire cluster, including restarting the pods. Our use case focused primarily on hardening the internal pods, which did not necessitate complex routing restrictions, and we designed tagging for different cluster components such as back-end pods, front-end pods, middleware, and two Kafka instances, successfully restricting communication among these internal clusters.
What is most valuable?
Though my experience with Isovalent has been brief, it has proven to be very useful using simple name tags for securing communications instead of IPs and ports. Additionally, at Layer 7, it allows configuration based on FQDN, making Cilium a flexible choice for defining secure rules.
Creating policies with Isovalent has been easier as it employs YAML files for configuration, which aligns well with those familiar with native Kubernetes deployments. It also features Layer 7 rule creation, which I find beneficial, evolving with capabilities such as eBPF for enhanced observability with gRPC, providing granular insights into clusters through Cilium.
Isovalent has positively impacted our organization by enabling control over communications restrictions in microservices, an essential feature since Kubernetes defaults to allowing all pod communications, addressing crucial cyber security concerns and helping implement a zero-trust model, which aligns with our cyber team's requirements for security benchmarking and auditing.
What needs improvement?
While I have not extensively used Isovalent products or Cilium, I have not identified areas for enhancement as of now.
For how long have I used the solution?
Regarding how long I have been working in my current field, specifically in the telecom domain, I have been working for 16 years, 12 years of which were spent in a public sector undertaking, and currently, I have been working for the past three and a half years in Tata Elxsi.
What do I think about the stability of the solution?
Isovalent has been stable based on my experience.
What do I think about the scalability of the solution?
Regarding Isovalent's scalability, our product has not been tested at scale in a real production environment with massive scalability needs, but in local setups where pods spawn and auto-scaling occurs, Isovalent Cilium product remains stable.
How are customer service and support?
We did not interact with customer support for Isovalent or Cilium, as we used their open-source tool.
Which solution did I use previously and why did I switch?
Prior to adopting Isovalent, we utilized various CNIs that I find less evolved compared to Cilium, which is a product from Isovalent.
How was the initial setup?
Isovalent is deployed in our organization using both on-premises settings and AWS cloud through EKS, allowing us to utilize both public cloud and on-premises infrastructure.
What about the implementation team?
We did not interact with customer support for Isovalent or Cilium, as we used their open-source tool.
What was our ROI?
I can state that we have experienced smoother audits post-implementation of Isovalent, successfully addressing primary auditing requirements. Financially, we have not documented a return on investment since we utilized their open-source Cilium product.
What's my experience with pricing, setup cost, and licensing?
I did not have the chance to explore pricing, setup costs, or licensing details, as we switched to a different product and telecom services post-creation, and I have not used Isovalent since.
Which other solutions did I evaluate?
Before choosing Isovalent, we evaluated other options, including Weave Net, albeit theoretically without implementation in a Kubernetes cluster.
What other advice do I have?
We did not purchase Isovalent through the AWS Marketplace.
On a scale of 1 to 10, I would rate Isovalent an eight, reflecting my short interaction of three to four months where it facilitated easy integration with our existing clusters, particularly for our use case where tagging microservices was straightforward.
I chose that rating as my experience involves implementing Isovalent for one product, and its ease of execution greatly aided our processes; however, I deducted two points because I have not explored their other products or fully implemented routing and BGP capabilities, which I have only encountered theoretically.
Regarding Isovalent's capabilities, I think its governance and security features are its main advantages, particularly the control over communications achieved through better name tags and FQDN URLs, which I have observed. Theoretically, I see governance and performance being tackled concurrently. I find its accuracy and reliability of output quite commendable, especially for our use case where we are able to maintain control over our intended traffic.
To others considering Isovalent, I would definitely recommend it, emphasizing the control over internal pod communications achievable with the well-evolved Cilium, and the ease of rule setting which does not necessitate network expertise. Appropriate naming tags can enable effective functional isolation across services. My overall rating for Isovalent is eight.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?