Technical Tip: Integrate MicroK8S with FortiCNAPP agent

[lpizziniaco]

Description	This article describes how to integrate a server MicroK8S with the FortiCNAPP agent
Scope	Lacework, FortiCNAPP.
Solution	The usage of a product like MicroK8s for production scopes can be considered debatable but in some scenarios where budget limitations exist, or the application requirements are relatively simple, MicroK8s can be more than adequate. In a productive deployment, MicroK8s can be just a small component of a more complex infrastructure, and it can be integrated with Lacework/FortiCNAPP even if the support can be in a sort of grey area.  To deploy the server itself, follow the official documentation. Once the MicroK8s is up and running, verify the cluster-name via the command: $ microk8s kubectl config view apiVersion: v1 clusters:  - cluster:      certificate-authority-data: DATA+OMITTED      server: https://127.0.0.1:8080    name: microk8s-cluster contexts:  - context:      cluster: microk8s-cluster      user: admin ... Before installing the agent on the Kubernetes host, an access token must be generated following the official documentation. Once the token has been generated, it must be used in the following command to install the agent: $ helm upgrade --install lacework-agent lacework/lacework-agent \  --create-namespace \  --namespace lacework \  --set laceworkConfig.serverUrl=https://api.lacework.net \  --set laceworkConfig.accessToken=<TOKEN> \  --set laceworkConfig.kubernetesCluster=<cluster-name> \  --set laceworkConfig.env=k8s The command above must succeed. It is important to notice that the serverUrl can be different in some deployments the official documentation shows all the possible values for serverUrl. The last part for making the integration fully operational is to add the correct tags in the config.json. To achieve this last step, a YAML file with the following shape must be edited as per documentation: apiVersion: v1 kind: ConfigMap metadata:   name: lacework-config data:   config.json: |     {"tokens":{"AccessToken":"<TOKEN>"}, "tags":{"Env":"k8s", "KubernetesCluster":"<cluster-name>" }, "serverurl":"https://api.lacework.net"} Let's call this file lacework-cfg-k8s.yaml, to inject it in the deployment the following command can be performed: $ microk8s kubectl replace -f lacework-cfg-k8s.yaml -n lacework Once this is done, it could take up to one hour to see the cluster in the Lacework/FortiCNAPP workload. Once the shape of the Lacework/FortiCNAPP GUI occurs, it would be something like the following: