Fortinet black logo

Administration Guide

AWS Kubernetes (EKS) SDN connector using access key

AWS Kubernetes (EKS) SDN connector using access key

AWS SDN connectors support dynamic address groups based on AWS Kubernetes (EKS) filters.

To enable an AWS SDN connector to fetch IP addresses from AWS Kubernetes:
  1. Go to Security Fabric > External Connectors. Click Create New, then select Amazon Web Services (AWS). Configure the SDN connector as desired. See AWS SDN connector using certificates

    Screenshot of SDN connector configuration for Amazon EKS

  2. Go to Policies & Objects > Addresses. Click Create New > Address to create a dynamic firewall address for the configured SDN connector using the supported Kubernetes filter.
  3. From the Type dropdown list, select Dynamic.
  4. From the Sub Type dropdown list, select Fabric Connector Address.
  5. From the SDN Connector dropdown list, select the desired SDN connector.
  6. In the Filter field, add the desired filters. The following filters are supported:

    Filter

    Description

    k8s_cluster

    Name of Kubernetes cluster.

    k8s_namespace

    Namespace of a Kubernetes service or pod.

    k8s_svcname

    Name of a Kubernetes service.

    k8s_nodename

    Name of a Kubernetes node.

    k8s_zone

    Zone of a Kubernetes node.

    k8s_region

    Region of a Kubernetes node.

    k8s_podname

    Name of a Kubernetes pod.

    k8s_label.xxx

    Name of label of a Kubernetes resource (cluster/service/node/pod).

    Screenshot of AWS Kubernetes setup displaying the creation of dynamic firewall address

  7. Configure the rest of the settings, then click OK.
  8. Ensure that the SDN connector resolves the dynamic firewall address IP addresses by going to Policy & Objects > Addresses and hovering over the newly created address.

    Screenshot displaying the IP being resolved by the SDN connector.

To configure an AWS Kubernetes SDN connector through the CLI:
  1. Configure the SDN connector:

    config system sdn-connector

    edit "aws1"

    set type aws

    set access-key "AKIAIJNKE75ANVN5AEQA"

    set secret-key xxxxx

    set region "us-west-2"

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the SDN connector with a supported Kubernetes filter:

    config firewall address

    edit "aws-pod"

    set type dynamic

    set sdn "aws1"

    set filter "K8S_PodName=aws-node-g6zhx"

    next

    end

    The SDN connector resolves the dynamic firewall address IP address:

    config firewall address

    edit "aws-pod"

    set type dynamic

    set sdn "aws1"

    set filter "K8S_PodName=aws-node-g6zhx"

    config list

    edit "192.168.114.197"

    next

    end

    next

    end

AWS Kubernetes (EKS) SDN connector using access key

AWS SDN connectors support dynamic address groups based on AWS Kubernetes (EKS) filters.

To enable an AWS SDN connector to fetch IP addresses from AWS Kubernetes:
  1. Go to Security Fabric > External Connectors. Click Create New, then select Amazon Web Services (AWS). Configure the SDN connector as desired. See AWS SDN connector using certificates

    Screenshot of SDN connector configuration for Amazon EKS

  2. Go to Policies & Objects > Addresses. Click Create New > Address to create a dynamic firewall address for the configured SDN connector using the supported Kubernetes filter.
  3. From the Type dropdown list, select Dynamic.
  4. From the Sub Type dropdown list, select Fabric Connector Address.
  5. From the SDN Connector dropdown list, select the desired SDN connector.
  6. In the Filter field, add the desired filters. The following filters are supported:

    Filter

    Description

    k8s_cluster

    Name of Kubernetes cluster.

    k8s_namespace

    Namespace of a Kubernetes service or pod.

    k8s_svcname

    Name of a Kubernetes service.

    k8s_nodename

    Name of a Kubernetes node.

    k8s_zone

    Zone of a Kubernetes node.

    k8s_region

    Region of a Kubernetes node.

    k8s_podname

    Name of a Kubernetes pod.

    k8s_label.xxx

    Name of label of a Kubernetes resource (cluster/service/node/pod).

    Screenshot of AWS Kubernetes setup displaying the creation of dynamic firewall address

  7. Configure the rest of the settings, then click OK.
  8. Ensure that the SDN connector resolves the dynamic firewall address IP addresses by going to Policy & Objects > Addresses and hovering over the newly created address.

    Screenshot displaying the IP being resolved by the SDN connector.

To configure an AWS Kubernetes SDN connector through the CLI:
  1. Configure the SDN connector:

    config system sdn-connector

    edit "aws1"

    set type aws

    set access-key "AKIAIJNKE75ANVN5AEQA"

    set secret-key xxxxx

    set region "us-west-2"

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the SDN connector with a supported Kubernetes filter:

    config firewall address

    edit "aws-pod"

    set type dynamic

    set sdn "aws1"

    set filter "K8S_PodName=aws-node-g6zhx"

    next

    end

    The SDN connector resolves the dynamic firewall address IP address:

    config firewall address

    edit "aws-pod"

    set type dynamic

    set sdn "aws1"

    set filter "K8S_PodName=aws-node-g6zhx"

    config list

    edit "192.168.114.197"

    next

    end

    next

    end