Splunk-connect-for-kubernetes: NW-Policy - Good Practice - Whitelist

[jsiegele]

Hi!
Since we want to implement the good practice "default deny all" kubernetes nw-policy,
we are looking for advices for the whitelist.

Does somebody already have implemented this approach?
Are there any implemenations known for splunk-connect-for-kubernetes?

Thank you very much!

MfG Johann

[matthewmodestino]

Do you mean "default deny all" traffic for traffic originated in the cluster, destined for outside the cluster??

[jsiegele]

Hi,
we would like to start by using this policy - deny ingress an egress traffic - except DNS

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  egress:
  # allow DNS resolution
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

So it will be hard to find all necessary communication routes on our own.

[matthewmodestino]

Cool!

There is no ingress for Splunk Connect for Kubernetes, so that part is straightforward.

The only traffic that should be allowed to egress is the connection from the connect for k8s pods (any of them) to the Splunk indexing components, which for now, I will assume is outside Openshift.

By default it is HTTP Event Collector on tcp8088, but can be tcp443 for Splunk Cloud.

We also make calls your cluster's k8s api from the objects and metrics-agg pods, and the metrics daemonset calls the local kubelet port served by the node they run on. These settings can be found in the configmap, or if you do kubectl logs on one of the pods, as we dump the rendered config at the head of the log.

Let us know if that gets you moving or if you need more info!

[jsiegele]

Thanks for our advice!!

So we implemented the following NW-Policies:

Default - Deny all:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: {{ .Release.Namespace }}
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  egress:
  # allow DNS resolution
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

Allow k8s API-Server

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-server
  namespace: {{ .Release.Namespace }}
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: {{ $.Values.apiServerIp }}/32
    ports:
    - protocol: TCP
      port: {{ $.Values.apiServerPort }}
{{- end }}

Allow Splunk-HEC Connect

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-splunk-hec-connect
  namespace: {{ .Release.Namespace }}
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
  - ports:
    - port: {{ $.Values.splunkHecListenerPort }}
      protocol: TCP
    to:
      - ipBlock:
          cidr: {{ $.Values.splunkHecServerIp }}/32

So right now i see Logentries in my splunk GUI - we will test the stuff.

Question: Makes it sense to add the NW-Policies to the official splunk-connect-for-kubernetes Projekt?