Skip to content

Commit

Permalink
fixed and added anchor links in both use cases
Browse files Browse the repository at this point in the history
  • Loading branch information
mapgirll committed May 7, 2024
1 parent 78a9fa0 commit 37f5e42
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 12 deletions.
10 changes: 5 additions & 5 deletions use-cases/microsegmentation.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -196,16 +196,16 @@ By verifying that correct flows are allowed and denied before enforcement, you c
To implement microsegmentation, you should follow a structured and repeatable approach to increase the likelihood of success.
These can be summarized as four broad steps:

1. [Identify the security domains](./microsegmentation#identification-of-security-domains) for which microsegmentation will be enforced, who will be responsible for them, and who or which services need access to those security domains.
1. [Identify the security domains](./microsegmentation#identify-your-security-domains) for which microsegmentation will be enforced, who will be responsible for them, and who or which services need access to those security domains.

2. [Define a policy](./microsegmentation#developing-policy-framework) model using documented microservice communication for your applications or by analyzing traffic flows.
2. [Define a policy](./microsegmentation#develop-a-policy-framework) model using documented microservice communication for your applications or by analyzing traffic flows.
When defining policies you should also consider the scope of the policies (global or namespace), who will be writing and applying the policies, and policy order (or tiers).

3. [Author and deploy network policies](./microsegmentation#deploy-security-policies).
Once all the correct allow policies are in place, stage a [default deny policy](./microsegmentation#enforce-default-deny).
3. [Author and deploy network policies](./microsegmentation#deploy-network-policies).
Once all the correct allow policies are in place, stage a [default deny policy](./microsegmentation#enforce-a-default-deny-policy).
You may want to identify a low-impact application or security domain first to understand and evaluate the process before prioritizing segmentation of critical security domains.

4. [Re-assess any flows](./microsegmentation#monitor-review-refine) or new applications that may require policy remediation before enforcing a default-deny.
4. [Re-assess any flows](./microsegmentation#monitor-and-fine-tune-your-policies) or new applications that may require policy remediation before enforcing a default-deny.
In Calico Open Source, where staged policies are not supported, enforce a default deny in a staging environment to correct any policies prior to enforcing in production.

### Identify your security domains
Expand Down
14 changes: 7 additions & 7 deletions use-cases/observability.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ One example might be a dashboard, showing various metrics to an end-user who nee
Observability could also go more granular than that, representing visually how different resources installed in the cluster are connected and dependent on each other.
In summary, observability is a way to visualize, organize and understand what’s going on in our Kubernetes clusters.

### Why do people use observability tools?
### Why use observability tools?

Kubernetes is by design a dynamic, distributed system, which can make it difficult to get the full picture of what’s happening inside a cluster.
This can make managing and troubleshooting your cluster difficult and time consuming, and may require the integration of multiple third-party tools to get the desired outputs.
Expand Down Expand Up @@ -161,7 +161,7 @@ If your visualization tools have highlighted a cause for concern that needs furt
This will likely be in the form of logs, which you can filter to target specific flows, workloads, or namespaces where the flow metadata can be reviewed.
Logs typically hold all of the information relating to a flow, and that information is simplified or extracted to provide a clearer focus in dashboards or visualizations.
Using other tools before you analyze log files helps you narrow down the scope of troubleshooting or analysis.
When you're ready to dive in to log files, you should already have a good idea of metadata to filter on or target, providing a more efficient approach to their investigation.
When you're ready to dive in to log files, you should already have a good idea of metadata to filter on or target, providing a more efficient approach to your investigation.

In Calico Enterprise and Calico Cloud, logs are stored in Elasticsearch.
There are several different log types that are collected:
Expand Down Expand Up @@ -253,11 +253,11 @@ This suits users who are using logs to narrow focus for a specific use or comple

Calico Enterprise and Calico Cloud's observability features go beyond visualizing the internals of a cluster, and provide a place to highlight potential issues or security concerns, troubleshoot communication issues, and even identify flows that need to be secured, such as:

* Network policies and flows
* Cluster traffic
* Flow properties and metadata
* DNS issues
* TCP performance
* [Network policies and flows](./observability#network-policies-and-flows)
* [Cluster traffic](./observability#cluster-traffic)
* [Flow properties and metadata](./observability#flow-properties-and-metadata)
* [DNS issues](./observability#dns)
* [TCP performance](./observability#tcp)

Each section has been grouped into a few different scenarios that outline how Calico Enterprise and Calico Cloud can help solve these use cases.

Expand Down

0 comments on commit 37f5e42

Please sign in to comment.