FortiEDR Communication Control causes Kubernetes cluster outage

Question

Hi Everybody,We are running a Kubernetes cluster on Rocky Linux 10.2 VMs, with the FortiEDR Linux Collector installed on the host OS.When FortiEDR Communication Control was changed from Simulation to Prevention, the entire Kubernetes cluster became unavailable. After changing the policy back to Simulation, the cluster recovered and became operational again.I have allowed everything regarding the connections to the outside after checking with my Dev Ops Engineer and we see no new logs regarding the communication control. The affected nodes reported this kernel message:Failed to initialize the IGMP autojoin socket (err -1)FortiEDR Collector version: 6.2.0.1350I double-checked the FortiEDR Events and Communication Control logs, but there were zero events showing that anything was blocked or denied by FortiEDR.Has anyone experienced a similar issue with FortiEDR Communication Control and Kubernetes? If you have any ideas or troubleshooting recommendations, I would really appreciate your help, as I am not a Kubernetes expert.Thank you in advance.

MohammedBahjat · Accepted Answer

Dear Stephen,Following up on our open ticket with Fortinet support, here is their assessment regarding why the block is occurring:"This explains why the block occurs: they don't contain the vendor metadata needed to allow it through the policy. In order to have package info, you have to install it from a package manager. If it's installed using a custom or dedicated install script for kubelet, it could be missing."they have provided us a script that will ensure that the metadata contains the vendor name so it will be allowed but we have not tested it yet.Mohammed Bahjat

Stephen_G · Answer

Hi MohammedBahjat,Thank you for using our forums. We will seek to get you an answer or help.In the meantime, if anyone else has any advice, please feel free to contribute.

Sign up

Login with SSO

Login to the community

Login with SSO