GCP Kubernetes (GKE) SDN connector

Google Cloud Platform (GCP) SDN connectors support dynamic address groups based on GCP Kubernetes Engine (GKE) filters.

To filter out the Kubernetes IP addresses, the following address filters have been introduced:

k8s_cluster	Name of Kubernetes cluster.
k8s_nodepool	Name of node pool for a Kubernetes cluster.
k8s_namespace	Namespace of a Kubernetes service or pod.
k8s_servicename	Name of a Kubernetes service.
k8s_nodename	Name of a Kubernetes node.
k8s_zone	Zone of a Kubernetes node.
k8s_region	Region of a Kubernetes node.
k8s_podname	Name of a Kubernetes pod.
k8s_label.xxx	Name of label of a Kubernetes resource (cluster/service/node/Pod).

To enable a GCP SDN connector to fetch IP addresses from GKE:

1. Go to Security Fabric > External Connectors, and configure an SDN connector for GCP.

   

2. Go to Policies & Objects > Addresses and create a dynamic firewall address for the configured SDN connector using the supported Kubernetes filter.
3. To filter out the Kubernetes IP addresses, select the address filter or filters. In this example, the GCP SDN connector will automatically populate and update IP addresses only for instances that belong to the zhm-kc3 cluster:

   

4. Configure the rest of the settings, then click OK.

   The dynamic firewall address IP is resolved by the SDN connector.

   

To configure a GCP Kubernetes SDN connector through the CLI:

1. Configure an SDN connector for Kubernetes:

   config system sdn-connector

   edit "gcp1"

   set type gcp

   set gcp-project "dev-project-001-166400"

   set service-account "966517025500-compute@developer.gserviceaccount.com"

   set update-interval 30

   next

   end

2. Create a dynamic firewall address for the SDN connector with a supported Kubernetes filter:

   config firewall address

   edit "gcp-k8s-cluster"

   set type dynamic

   set sdn "gcp1"

   set filter "K8S_Cluster=zhm-kc3"

   next

   end

   The dynamic firewall address IP is resolved by the SDN connector:

   config firewall address

   edit "gcp-k8s-cluster"

   set type dynamic

   set sdn "gcp1"

   set filter "K8S_Cluster=zhm-kc3"

   config list

   edit "10.0.2.4"

   next

   edit "10.0.2.7"

   next

   edit "10.28.0.13"

   next

   end

   next

   end