Connect Akto eBPF with Kubernetes
Last updated
Last updated
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: pod-watcher
namespace: {NAMESPACE}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: pod-watcher-role
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: pod-watcher-role-binding
subjects:
- kind: ServiceAccount
name: pod-watcher
namespace: {NAMESPACE}
roleRef:
kind: ClusterRole
name: pod-watcher-role
apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: akto-k8s
namespace: {NAMESPACE}
labels:
app: akto-collector
spec:
selector:
matchLabels:
app: akto-collector
template:
metadata:
labels:
app: akto-collector
spec:
hostNetwork: true
serviceAccountName: pod-watcher
dnsPolicy: ClusterFirstWithHostNet
hostPID: true
containers:
- name: mirror-api-logging
image: public.ecr.aws/aktosecurity/mirror-api-logging:k8s_ebpf
resources:
limits:
cpu: 500m
memory: 1Gi
requests:
cpu: 50m
memory: 50Mi
env:
- name: AKTO_TRAFFIC_BATCH_TIME_SECS
value: "10"
- name: AKTO_TRAFFIC_BATCH_SIZE
value: "100"
- name: AKTO_KAFKA_BROKER_MAL
value: "<AKTO_NLB_IP>:9092"
- name: AKTO_K8_METADATA_CAPTURE
value: "true"
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
securityContext:
capabilities:
add:
- SYS_PTRACE
- SYS_ADMIN
privileged: true
volumeMounts:
# needed to load kernel headers
- name: lib-modules
mountPath: /lib/modules
readOnly: true
# needed to trace kernel events
- name: sys-kernel
mountPath: /sys/kernel
readOnly: true
- name: host
mountPath: /host
readOnly: true
volumes:
- name: sys-kernel
hostPath:
path: /sys/kernel
- name: lib-modules
hostPath:
path: /lib/modules
- name: host
hostPath:
path : /# This helps in filtering traffic sent to akto, based on certain headers. Here is an example for sending traffic only for 'bookinfo' namespace in an istio setup.
- name: AKTO_MODULE_DISCOVERY_CONFIG
value: '[{"key":{"eq":"x-forwarded-client-cert","ifAbsent":"reject"},"value":{"regex":".*bookinfo.*"}}]'
# Time limit ( in seconds ) after which, a traffic stream is processed and marked inactive. The same stream, is not processed again.
- name: TRAFFIC_INACTIVITY_THRESHOLD
value: "30"
# Max traffic connections kept in memory
- name: TRAFFIC_MAX_ACTIVE_CONN
value: "4096"
# Make this flag true to disable egress traffic. It is recommended to keep this false.
- name: TRAFFIC_DISABLE_EGRESS
value: "false"
# Max mem usage after which the pod restarts ( in MB )
- name: AKTO_MEM_THRESH_RESTART
value: "800"
# Max limit of traffic buffer kept in memory ( in MB )
- name: TRAFFIC_BUFFER_THRESHOLD
value: "600"
# Ignore traffic coming from unresolved IPs, i.e. requests with host header of the format <a.b.c.d>
- name: AKTO_IGNORE_IP_TRAFFIC
value: "false"
# Ignore traffic coming from AWS cloud metadata IP
- name: AKTO_IGNORE_CLOUD_METADATA_CALLS
value: "false"
# The interval poll ( in seconds ) in which data is sent to Akto data processor.
- name: KAFKA_POLL_INTERVAL
value: "0.5"
# If you only want to trace traffic for which SSL termination happens at proxy/service.
- name: CAPTURE_ALL
value: "false"# This will start capturing the pod labels from all namespaces except
# kube-system, kube-public and kube-node-lease
- name: AKTO_K8_METADATA_CAPTURE
value: "true"
# Use this if you want to capture pod labels from a specific namespace only.
- name: AKTO_K8_METADATA_CAPTURE_NAMESPACE
value: {NAMESPACE}