Fortinet black logo

Cookbook

AWS Kubernetes (EKS) SDN connector

Copy Link
Copy Doc ID 5be0d1a4-3f0d-11eb-96b9-00505692583a:243307
Download PDF

AWS Kubernetes (EKS) SDN connector

AWS SDN connectors support dynamic address groups based on AWS Kubernetes (EKS) filters.

To filter out the Kubernetes IP addresses, the following address filters have been introduced:

k8s_cluster

Name of Kubernetes cluster.

k8s_namespace

Namespace of a Kubernetes service or pod.

k8s_svcname

Name of a Kubernetes service.

k8s_nodename

Name of a Kubernetes node.

k8s_zone

Zone of a Kubernetes node.

k8s_region

Region of a Kubernetes node.

k8s_podname

Name of a Kubernetes pod.

k8s_label.xxx

Name of label of a Kubernetes resource (cluster/service/node/Pod).

To enable an AWS SDN connector to fetch IP addresses from AWS Kubernetes:
  1. In Fabric Connectors, configure an SDN connector for AWS Kubernetes.

    Screenshot of SDN connector configuration for Amazon EKS

  2. Go to Policies & Objects > Addresses and create a dynamic firewall address for the configured SDN connector using the supported Kubernetes filter.
  3. To filter out the Kubernetes IP addresses, select the address filter or filters.

    Screenshot of AWS Kubernetes setup displaying the creation of dynamic firewall address

  4. Configure the rest of the settings, then click OK.

    The dynamic firewall address IP is resolved by the SDN connector.

    Screenshot displaying the IP being resolved by the SDN connector.

To configure an AWS Kubernetes SDN connector through the CLI:
  1. Configure an SDN connector for Kubernetes:

    config system sdn-connector

    edit "aws1"

    set type aws

    set access-key "AKIAIJNKE75ANVN5AEQA"

    set secret-key xxxxx

    set region "us-west-2"

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the SDN connector with a supported Kubernetes filter:

    config firewall address

    edit "aws-pod"

    set type dynamic

    set sdn "aws1"

    set filter "K8S_PodName=aws-node-g6zhx"

    next

    end

    The dynamic firewall address IP is resolved by the SDN connector:

    config firewall address

    edit "aws-pod"

    set uuid a7a37298-19e6-51e9-851a-2c551ffc174d

    set type dynamic

    set sdn "aws1"

    set filter "K8S_PodName=aws-node-g6zhx"

    config list

    edit "192.168.114.197"

    next

    end

    next

    end

AWS Kubernetes (EKS) SDN connector

AWS SDN connectors support dynamic address groups based on AWS Kubernetes (EKS) filters.

To filter out the Kubernetes IP addresses, the following address filters have been introduced:

k8s_cluster

Name of Kubernetes cluster.

k8s_namespace

Namespace of a Kubernetes service or pod.

k8s_svcname

Name of a Kubernetes service.

k8s_nodename

Name of a Kubernetes node.

k8s_zone

Zone of a Kubernetes node.

k8s_region

Region of a Kubernetes node.

k8s_podname

Name of a Kubernetes pod.

k8s_label.xxx

Name of label of a Kubernetes resource (cluster/service/node/Pod).

To enable an AWS SDN connector to fetch IP addresses from AWS Kubernetes:
  1. In Fabric Connectors, configure an SDN connector for AWS Kubernetes.

    Screenshot of SDN connector configuration for Amazon EKS

  2. Go to Policies & Objects > Addresses and create a dynamic firewall address for the configured SDN connector using the supported Kubernetes filter.
  3. To filter out the Kubernetes IP addresses, select the address filter or filters.

    Screenshot of AWS Kubernetes setup displaying the creation of dynamic firewall address

  4. Configure the rest of the settings, then click OK.

    The dynamic firewall address IP is resolved by the SDN connector.

    Screenshot displaying the IP being resolved by the SDN connector.

To configure an AWS Kubernetes SDN connector through the CLI:
  1. Configure an SDN connector for Kubernetes:

    config system sdn-connector

    edit "aws1"

    set type aws

    set access-key "AKIAIJNKE75ANVN5AEQA"

    set secret-key xxxxx

    set region "us-west-2"

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the SDN connector with a supported Kubernetes filter:

    config firewall address

    edit "aws-pod"

    set type dynamic

    set sdn "aws1"

    set filter "K8S_PodName=aws-node-g6zhx"

    next

    end

    The dynamic firewall address IP is resolved by the SDN connector:

    config firewall address

    edit "aws-pod"

    set uuid a7a37298-19e6-51e9-851a-2c551ffc174d

    set type dynamic

    set sdn "aws1"

    set filter "K8S_PodName=aws-node-g6zhx"

    config list

    edit "192.168.114.197"

    next

    end

    next

    end