Configure packet forwarding for pods in EKS

Before you can configure the ExtraHop system to monitor pods in EKS, you must retrieve the subnets allocated to the pods and allocated to the services the pods support.

1. Retrieve the subnets for pods.
   1. In the AWS console, click Services and then select Elastic Kubernetes Service.
   2. Click Clusters.
   3. Click the name of the cluster that contains the pods you want to monitor.
   4. Click the Configuration tab.
   5. Click the Networking tab.
   6. For each subnet in the Subnets section, click the subnet, and then note the CIDR block in the IPv4 CIDR column of the Subnets table.
2. Retrieve the subnets for services.
   1. Return to the Networking tab on the Cluster page.
   2. Note the CIDR block under Service IPv4 range.

With L2 discovery, the ExtraHop system assigns all IP addresses to an associated L2 device; this is the default setting for ExtraHop systems. If L2 discovery is enabled, you must configure the ExtraHop system to discover Kubernetes pods as remote devices, even if the pods are located on nodes inside your local network. Otherwise, the pod IP addresses will only be associated with the corresponding L2 devices for the Kubernetes nodes, and the system will not track the pods as separate devices.

Create a container image for the containers that will forward packets to the ExtraHop system. After you create the container image, you must store the image in a registry that is accessible to all nodes in the EKS cluster. The registry can be the AWS Elastic Container Registry (ECR) or another third-party registry.

1. Go to the ExtraHop code-examples GitHub repository and download the deploy_kubernetes_daemon directory.
2. Download the RPCAP install files to the deploy_kubernetes_daemon directory.
   Click the download link under Installation package for Ubuntu 22.04.
3. Open a terminal application and navigate to the deploy_kubernetes_daemon directory.
4. Run the following command to create the docker container image:

   docker build -t rpcapd --build-arg RPCAPD_DEB_ARCHIVE=<RPCAP_install_file> .

   Copy

   Replace <RPCAP_install_file> with the filename of the RPCAP install file.

5. If you are storing the image in ECR, log in to the registry:

   aws ecr get-login-password --region REGION | docker login --username AWS --password-stdin EXAMPLE_REGISTRY

   Copy
6. Tag the image in a registry that can be accessed by all nodes in your Kubernetes cluster:

   docker tag rpcapd EXAMPLE-REGISTRY/rpcapd:latest

   Copy

   Note:

   You must replace EXAMPLE_REGISTRY with the name of your registry.

7. Push the image to the registry:

   docker image push EXAMPLE-REGISTRY/rpcapd:latest

   Copy

1. Write the DaemonSet spec file.
   1. Go to the ExtraHop code-examples GitHub repository and download the deploy_kubernetes_daemon/rpcapd_daemon.yaml file to the rpcapd directory.
   2. In the rpcapd directory, open the rpcapd_daemon.yaml file in a text editor.
   3. Replace the values for the following variables with information from your environment:

      image

      The name and registry location of the image you created in the previous procedure. For example:

      EXAMPLE-REGISTRY/rpcapd:latest

      Copy

      Tip:	If you are storing the image in ECR, you can retrieve this string from the AWS Console by clicking Services, and then selecting Elastic Container Registry, then clicking the name of the repository you pushed the image to, and then clicking the copy icon in the Image URI column.

      env.name = EXTRAHOP_SENSOR_IP

      The IP address of the ExtraHop sensor

      env.name = RPCAPD_TARGET_PORT

      The port on the ExtraHop sensor that you assigned the packet-forwarding rule to.

      env.name = PODNET

      The subnets of the pods in your cluster that you retrieved earlier, in a comma-separated list.

      env.name = SVCNET

      The subnets of the services in your cluster that you retrieved earlier, in a comma-separated list.

   4. Save and close the rpcapd_daemon.yaml file.
2. Deploy the DaemonSet by running the following command:

   kubectl apply -f rpcapd_daemon.yaml

   Copy

   The system displays output similar to the following text:

   namespace/extrahop created
   daemonset.apps/extrahop-rpcapd created

   Copy
3. Confirm that the deployment was successful:

   kubectl wait pod -n extrahop -l component=extrahop-rpcapd --for=condition=Ready

   Copy

   When a pod is deployed, the command displays output similar to the following text:

   pod/extrahop-rpcapd-vfctb condition met

   Copy

   After every pod is deployed, the command exits.

   You can now view metrics for pods in your EKS cluster in the ExtraHop system.