Fortinet black logo

Administration Guide

GCP Kubernetes (GKE) SDN connector using service account

GCP Kubernetes (GKE) SDN connector using service account

Google Cloud Platform (GCP) SDN connectors support dynamic address groups based on GCP Kubernetes Engine (GKE) filters.

To enable a GCP SDN connector to fetch IP addresses from GKE:
  1. Configure an SDN connector for GCP:

    1. Go to Security Fabric > External Connectors. Click Create New, and select Google Cloud Platform (GCP).
    2. Enter a connector name, then configure the following settings for the GCP connector:
      1. Projects: Select Simple.
      2. Name: Enter the name of the GCP project.
      3. Service account email: Enter the email address associated with the service account that will call APIs to the GCP project specified above.
      4. Private key: Enter the private key statement.
    3. Screenshot of SDN connector configuration for GCP

    4. Click OK.

  2. Go to Policies & Objects > Addresses and create a dynamic firewall address for the configured SDN connector using the supported Kubernetes filter.
  3. To filter out the Kubernetes IP addresses, select the address filter or filters. The following filters are supported:

    Filter

    Description

    k8s_cluster

    Name of Kubernetes cluster.

    k8s_namespace

    Namespace of a Kubernetes service or pod.

    k8s_svcname

    Name of a Kubernetes service.

    k8s_nodename

    Name of a Kubernetes node.

    k8s_zone

    Zone of a Kubernetes node.

    k8s_region

    Region of a Kubernetes node.

    k8s_podname

    Name of a Kubernetes pod.

    k8s_label.xxx

    Name of label of a Kubernetes resource (cluster/service/node/Pod).

    In this example, the GCP SDN connector will automatically populate and update IP addresses only for instances that belong to the zhm-kc3 cluster:

    Screenshot of GCP Kubernetes setup displaying the creation of dynamic firewall address

  4. Configure the rest of the settings, then click OK.

    The dynamic firewall address IP is resolved by the SDN connector.

    Screenshot displaying the IP being resolved by the SDN connector.

To configure a GCP Kubernetes SDN connector through the CLI:
  1. Configure an SDN connector for Kubernetes:

    config system sdn-connector

    edit "gcp1"

    set type gcp

    config gcp-project-list

    edit "dev-project-001-166400"

    next

    set service-account "966517025500-compute@developer.gserviceaccount.com"

    set private-key **********

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the SDN connector with a supported Kubernetes filter:

    config firewall address

    edit "gcp-k8s-cluster"

    set type dynamic

    set sdn "gcp1"

    set filter "K8S_Cluster=zhm-kc3"

    next

    end

    The dynamic firewall address IP is resolved by the SDN connector:

    config firewall address

    edit "gcp-k8s-cluster"

    set type dynamic

    set sdn "gcp1"

    set filter "K8S_Cluster=zhm-kc3"

    config list

    edit "10.0.2.4"

    next

    edit "10.0.2.7"

    next

    edit "10.28.0.13"

    next

    end

    next

    end

GCP Kubernetes (GKE) SDN connector using service account

Google Cloud Platform (GCP) SDN connectors support dynamic address groups based on GCP Kubernetes Engine (GKE) filters.

To enable a GCP SDN connector to fetch IP addresses from GKE:
  1. Configure an SDN connector for GCP:

    1. Go to Security Fabric > External Connectors. Click Create New, and select Google Cloud Platform (GCP).
    2. Enter a connector name, then configure the following settings for the GCP connector:
      1. Projects: Select Simple.
      2. Name: Enter the name of the GCP project.
      3. Service account email: Enter the email address associated with the service account that will call APIs to the GCP project specified above.
      4. Private key: Enter the private key statement.
    3. Screenshot of SDN connector configuration for GCP

    4. Click OK.

  2. Go to Policies & Objects > Addresses and create a dynamic firewall address for the configured SDN connector using the supported Kubernetes filter.
  3. To filter out the Kubernetes IP addresses, select the address filter or filters. The following filters are supported:

    Filter

    Description

    k8s_cluster

    Name of Kubernetes cluster.

    k8s_namespace

    Namespace of a Kubernetes service or pod.

    k8s_svcname

    Name of a Kubernetes service.

    k8s_nodename

    Name of a Kubernetes node.

    k8s_zone

    Zone of a Kubernetes node.

    k8s_region

    Region of a Kubernetes node.

    k8s_podname

    Name of a Kubernetes pod.

    k8s_label.xxx

    Name of label of a Kubernetes resource (cluster/service/node/Pod).

    In this example, the GCP SDN connector will automatically populate and update IP addresses only for instances that belong to the zhm-kc3 cluster:

    Screenshot of GCP Kubernetes setup displaying the creation of dynamic firewall address

  4. Configure the rest of the settings, then click OK.

    The dynamic firewall address IP is resolved by the SDN connector.

    Screenshot displaying the IP being resolved by the SDN connector.

To configure a GCP Kubernetes SDN connector through the CLI:
  1. Configure an SDN connector for Kubernetes:

    config system sdn-connector

    edit "gcp1"

    set type gcp

    config gcp-project-list

    edit "dev-project-001-166400"

    next

    set service-account "966517025500-compute@developer.gserviceaccount.com"

    set private-key **********

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the SDN connector with a supported Kubernetes filter:

    config firewall address

    edit "gcp-k8s-cluster"

    set type dynamic

    set sdn "gcp1"

    set filter "K8S_Cluster=zhm-kc3"

    next

    end

    The dynamic firewall address IP is resolved by the SDN connector:

    config firewall address

    edit "gcp-k8s-cluster"

    set type dynamic

    set sdn "gcp1"

    set filter "K8S_Cluster=zhm-kc3"

    config list

    edit "10.0.2.4"

    next

    edit "10.0.2.7"

    next

    edit "10.28.0.13"

    next

    end

    next

    end