Technical Tip: Private Cloud K8s SDN connector

[krajaa]

Description
This article explains private Cloud K8s SDN connector.

Solution
FortiOS automatically updates dynamic addresses for Kubernetes (K8S) by using a K8S SDN connector, enabling FortiOS to manage K8S pods as global address objects, as with other connectors.
This includes mapping the following attributes from K8S instances to dynamic address groups in FortiOS:

Configure the K8S SDN connector.

- Go to Security Fabric -> Fabric Connectors.
- Select 'Create New', and select 'Kubernetes'.
- Configure as shown substituting the IP address, port number, and secret FortiToken for the deployment. The update interval is in seconds.

Create a dynamic firewall address for the configured K8S SDN connector.

- Go to Policy & Objects -> Addresses.
- Select 'Create New', then select 'Address'.
- Configure the address as shown, selecting the desired filter in the Filter dropdown list.

In this example, the K8S SDN connector will automatically populate and update IP addresses only for node instances that match the specified node name:

Ensure that the K8S SDN connector resolves dynamic firewall IP addresses.

- Go to Policy & Objects -> Addresses.

Hover over the address created to see a list of IP addresses for node instances that match the node name configured:

To configure K8S SDN connector from CLI.

- Configure the K8S SDN connector:

# config system sdn-connector
    edit "kubernetes1"
        set type kubernetes
        set server "172.18.64.38"
        set server-port 6443
        set secret-token xxxxx
        set update-interval 30
    next
end

- Create a dynamic firewall address for the configured K8S SDN connector with the supported K8S filter.
In this example, the K8S SDN connector will automatically populate and update IP addresses only for node instances that match the specified node name:

# config firewall address
    edit "k8s_nodename"
        set type dynamic
        set sdn "kubernetes1"
        set filter "K8S_NodeName=van-201669-pc1"
    next
end

- Confirm that the K8S SDN connector resolves dynamic firewall IP addresses using the configured filter:

# config firewall address
    edit "k8s_nodename"
        set uuid 462112a2-1ab1-51e9-799c-652621ba8c0c
        set type dynamic
        set sdn "kubernetes1"
        set filter "K8S_NodeName=van-201669-pc1"
# config list
    edit "172.16.65.227"
next
end
next
end