Enforcement on Containers
For an overview of the steps that are required to set up segmentation on container-based workloads that are managed by Kubernetes and OpenShift, see Set Up Microsegmentation for Kubernetes-Based Workloads.
|
Agents running on Kubernetes/OpenShift hosts must be configured to preserve existing rules. In order to prevent enforcement from interfering with iptables rules added by Kubernetes, the agent must be configured with a profile that has the Preserve Rules option enabled. See Creating an Agent Config Profile |
When enforcing policies on containers, Secure Workload allows Kubernetes/OpenShift service abstractions to be used as providers. Internally, the policies for service abstractions are transformed into rules for the provider pods and the nodes they are running on. This transformation depends on the type of the Kubernetes/OpenShift service, and it is dynamically updated whenever changes are received from the API server.
|
|
For NodePort and KubeloadBalancer services, the flows are routed at the node level. Hence, ensure that the policy is created at the app scope workspace where the nodes belong. Otherwise, the rules will not be generated on the node. |
The following example illustrates the flexibility made possible by this feature. Consider the following policy which allows traffic from all hosts and pods with the label environment = production to a Kubernetes service of type NodePort with the name db which exposes TCP port 27017 on a set of pods.
|
Consumer |
Provider |
Protocol/Port |
Action |
|---|---|---|---|
|
environment = production OR orchestrator_environment = production |
orchestrator_system/service_name = db |
TCP 27017 |
Allow |
This policy would result in the following firewall rules:
-
On hosts and pods that are labeled with environment = production, allow outgoing connections to all Kubernetes nodes of the cluster to which the service belongs. This rule uses the node port that is assigned to this service by Kubernetes.
-
On pods with the label environment = production, allow outgoing connections to the ClusterIP assigned to this service by Kubernetes. This rule uses the port that is exposed by the service (TCP 27017).
-
On Kubernetes nodes of the cluster to which the service belongs, allow outgoing connections to the provider pods. This rule uses the target port that is exposed by the service (TCP 27017).
-
On pods providing the service db, all incoming connections from all kubernetes nodes and consumer hosts and pods. This rule uses the target port that is exposed by the service (TCP 27017).
Changes to the type of the service, ports, and set of provider pods will immediately be picked up by Secure Workload rule generator and used to update the generated firewall rules.
|
Policies including Kubernetes/OpenShift inventory must be designed carefully to avoid conflicting with the internal operation of the kubernetes cluster. Kubernetes/OpenShift items imported by Secure Workload include the pods and services constituting the kubernetes cluster (for example, pods in the kube-system namespace). This allows precise policies to be defined to secure the kubernetes cluster itself, but it also means that badly designed policies can affect the operation of the cluster. |