GCP Kubernetes (GKE) SDN connector using service account
Google Cloud Platform (GCP) SDN connectors support dynamic address groups based on GCP Kubernetes Engine (GKE) filters.
To enable a GCP SDN connector to fetch IP addresses from GKE:
- Go to Security Fabric > External Connectors, and configure an SDN connector for GCP.
- Go to Policies & Objects > Addresses and create a dynamic firewall address for the configured SDN connector using the supported Kubernetes filter.
- To filter out the Kubernetes IP addresses, select the address filter or filters.
The following filters are supported:
Filter
Description
k8s_cluster
Name of Kubernetes cluster.
k8s_namespace
Namespace of a Kubernetes service or pod.
k8s_svcname
Name of a Kubernetes service.
k8s_nodename
Name of a Kubernetes node.
k8s_zone
Zone of a Kubernetes node.
k8s_region
Region of a Kubernetes node.
k8s_podname
Name of a Kubernetes pod.
k8s_label.xxx
Name of label of a Kubernetes resource (cluster/service/node/Pod).
In this example, the GCP SDN connector will automatically populate and update IP addresses only for instances that belong to the zhm-kc3 cluster:
- Configure the rest of the settings, then click OK.
The dynamic firewall address IP is resolved by the SDN connector.
To configure a GCP Kubernetes SDN connector through the CLI:
- Configure an SDN connector for Kubernetes:
config system sdn-connector
edit "gcp1"
set type gcp
set gcp-project "dev-project-001-166400"
set service-account "966517025500-compute@developer.gserviceaccount.com"
set update-interval 30
next
end
- Create a dynamic firewall address for the SDN connector with a supported Kubernetes filter:
config firewall address
edit "gcp-k8s-cluster"
set type dynamic
set sdn "gcp1"
set filter "K8S_Cluster=zhm-kc3"
next
end
The dynamic firewall address IP is resolved by the SDN connector:
config firewall address
edit "gcp-k8s-cluster"
set type dynamic
set sdn "gcp1"
set filter "K8S_Cluster=zhm-kc3"
config list
edit "10.0.2.4"
next
edit "10.0.2.7"
next
edit "10.28.0.13"
next
end
next
end