Description
This article describes methods to apply filter on Kubernetes address from Private Cloud SDN Connector to obtain specific IP Address.
Scope
FortiGate.
Solution
FortiGate queries the Kubernetes API to obtain the IP Address in the cluster dynamically.
In order to apply the addresses in the firewall policy, address objects are required to be created in FortiGate. Go to Policy & Objects- > Addresses, select 'Create New' -> Address:
In the filter drop-down list, FortiGate will provide options for different filters based on Namespaces, Pods, Services, Nodes, etc.
Note:
The SDN address type can be changed to 'All' if specific addresses are unable to resolve in FortiGate to query for more address types in Kubernetes.
1) Multiple filters:
In some environments, some specific IP addresses will need more restriction and protection from FortiGate. In that case, an additional filter can be applied to the Kubernetes addresses.
In the filter Column, select the '+' sign to apply an extra filter on the Kubernetes address.
Additionally, the logic button located on the right side of the filter can be toggled to apply 'and' or 'or' logic to the filter for a more dynamic application.
After the address is created, it can be verified in FortiGate -> Policy & Objects -> Kubernetes Address Name, hover the pointer to the address and choose 'Matched Address List'.
In this example, 2 filters for Service Name are applied. The Service addresses shown in the FortiGate are the same as the Service addresses in the Kubernetes Cluster indicating the filter is applied successfully.
2) Multiple interface:
If the FortiGate is connected to multiple Kubernetes clusters with different interfaces, the address can be created with a specific interface. By default, interface 'any' is applied and FortiGate will apply the filter and match the IP Addresses from all interfaces.
In the interface column, specify the interface connected to specific Kubernetes.
In this example, FortiGate will match the IP Address from port 2 only.
Related documents:
https://docs.fortinet.com/document/fortigate/6.2.0/new-features/673021/kubernetes-k8s
