Fortinet Document Library

Version:

Version:

Version:


Table of Contents

Related Videos

sidebar video

SDN Connector for Kubernetes Platform

  • 565 views
  • 2 years ago

More Links

Automatically updating dynamic addresses using Calico FortiGate integration

Administration Guide

Download PDF
Copy Link

Private cloud K8s SDN connector using secret token

FortiOS automatically updates dynamic and cluster IP addresses for Kubernetes (K8s) by using a K8s SDN connector, enabling FortiOS to manage K8s pods as global address objects, as with other connectors. This includes mapping the following attributes from K8s instances to dynamic address groups in FortiOS:

Filter Description
Namespace Filter service IP addresses in a given namespace.
ServiceName Filter service IP addresses by the given service name.
NodeName Filter node IP addresses by the given node name.

PodName

Filter IP addresses by the pod name.
Label.XXX Filter service or node IP addresses with the given label XXX. For example: K8S_Label.app=nginx.

FortiOS 6.2.3 and later collect cluster IP addresses in addition to external IP addresses for exposed K8s services.

Note

There is no maximum limit for the number of IP addresses populated with the filters.

To configure K8s SDN connector using the GUI:
  1. Configure the K8s SDN connector:
    1. Go to Security Fabric > External Connectors > Create New Connector.
    2. Select Kubernetes.
    3. In the IP field, enter the IP address that you obtained in Obtaining the IP address, port, and secret token in Kubernetes.
    4. In the Port field, select Specify, then enter the port that you obtained in Obtaining the IP address, port, and secret token in Kubernetes.
    5. In the Secret token field, enter the token that you obtained in Obtaining the IP address, port, and secret token in Kubernetes.
    6. Configure the other fields as desired.
  2. Create a dynamic firewall address for the configured K8S SDN connector:
    1. Go to Policy & Objects > Addresses.
    2. Click Create New, then select Address.
    3. Configure the address as shown, selecting the desired filter in the Filter dropdown list. In this example, the K8s SDN connector will automatically populate and update IP addresses only for node instances that match the specified node name:

  3. Ensure that the K8s SDN connector resolves dynamic firewall IP addresses:
    1. Go to Policy & Objects > Addresses.
    2. Hover over the address created in step 2 to see a list of IP addresses for node instances that match the node name configured in step 2:

To configure K8s SDN connector using CLI commands:
  1. Configure the K8s SDN connector:

    config system sdn-connector

    edit "kubernetes1"

    set type kubernetes

    set server "<IP address obtained in Obtaining the IP address, port, and secret token in Kubernetes>"

    set server-port <Port obtained in Obtaining the IP address, port, and secret token in Kubernetes>

    set secret-token <Secret token obtained in Obtaining the IP address, port, and secret token in Kubernetes>

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the configured K8s SDN connector with the supported K8s filter. In this example, the K8s SDN connector will automatically populate and update IP addresses only for node instances that match the specified node name:

    config firewall address

    edit "k8s_nodename"

    set type dynamic

    set sdn "kubernetes1"

    set filter "K8S_NodeName=van-201669-pc1"

    next

    end

  3. Confirm that the K8s SDN connector resolves dynamic firewall IP addresses using the configured filter:

    config firewall address

    edit "k8s_nodename"

    set type dynamic

    set sdn "kubernetes1"

    set filter "K8S_NodeName=van-201669-pc1"

    config list

    edit "172.16.65.227"

    next

    end

    next

    end

To troubleshoot the connection:
  1. In FortiOS, run the following commands:

    diagnose deb application kubed -1

    diagnose debug enable

  2. Reset the connection on the web UI to generate logs and troubleshoot the issue. The following shows the output in the case of a failure:

    The following shows the output in the case of a success:

Related Videos

sidebar video

SDN Connector for Kubernetes Platform

  • 565 views
  • 2 years ago

More Links

Private cloud K8s SDN connector using secret token

FortiOS automatically updates dynamic and cluster IP addresses for Kubernetes (K8s) by using a K8s SDN connector, enabling FortiOS to manage K8s pods as global address objects, as with other connectors. This includes mapping the following attributes from K8s instances to dynamic address groups in FortiOS:

Filter Description
Namespace Filter service IP addresses in a given namespace.
ServiceName Filter service IP addresses by the given service name.
NodeName Filter node IP addresses by the given node name.

PodName

Filter IP addresses by the pod name.
Label.XXX Filter service or node IP addresses with the given label XXX. For example: K8S_Label.app=nginx.

FortiOS 6.2.3 and later collect cluster IP addresses in addition to external IP addresses for exposed K8s services.

Note

There is no maximum limit for the number of IP addresses populated with the filters.

To configure K8s SDN connector using the GUI:
  1. Configure the K8s SDN connector:
    1. Go to Security Fabric > External Connectors > Create New Connector.
    2. Select Kubernetes.
    3. In the IP field, enter the IP address that you obtained in Obtaining the IP address, port, and secret token in Kubernetes.
    4. In the Port field, select Specify, then enter the port that you obtained in Obtaining the IP address, port, and secret token in Kubernetes.
    5. In the Secret token field, enter the token that you obtained in Obtaining the IP address, port, and secret token in Kubernetes.
    6. Configure the other fields as desired.
  2. Create a dynamic firewall address for the configured K8S SDN connector:
    1. Go to Policy & Objects > Addresses.
    2. Click Create New, then select Address.
    3. Configure the address as shown, selecting the desired filter in the Filter dropdown list. In this example, the K8s SDN connector will automatically populate and update IP addresses only for node instances that match the specified node name:

  3. Ensure that the K8s SDN connector resolves dynamic firewall IP addresses:
    1. Go to Policy & Objects > Addresses.
    2. Hover over the address created in step 2 to see a list of IP addresses for node instances that match the node name configured in step 2:

To configure K8s SDN connector using CLI commands:
  1. Configure the K8s SDN connector:

    config system sdn-connector

    edit "kubernetes1"

    set type kubernetes

    set server "<IP address obtained in Obtaining the IP address, port, and secret token in Kubernetes>"

    set server-port <Port obtained in Obtaining the IP address, port, and secret token in Kubernetes>

    set secret-token <Secret token obtained in Obtaining the IP address, port, and secret token in Kubernetes>

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the configured K8s SDN connector with the supported K8s filter. In this example, the K8s SDN connector will automatically populate and update IP addresses only for node instances that match the specified node name:

    config firewall address

    edit "k8s_nodename"

    set type dynamic

    set sdn "kubernetes1"

    set filter "K8S_NodeName=van-201669-pc1"

    next

    end

  3. Confirm that the K8s SDN connector resolves dynamic firewall IP addresses using the configured filter:

    config firewall address

    edit "k8s_nodename"

    set type dynamic

    set sdn "kubernetes1"

    set filter "K8S_NodeName=van-201669-pc1"

    config list

    edit "172.16.65.227"

    next

    end

    next

    end

To troubleshoot the connection:
  1. In FortiOS, run the following commands:

    diagnose deb application kubed -1

    diagnose debug enable

  2. Reset the connection on the web UI to generate logs and troubleshoot the issue. The following shows the output in the case of a failure:

    The following shows the output in the case of a success: