Configure packet forwarding for Kubernetes pods
By default, all traffic between nodes in a Kubernetes cluster is seen by the ExtraHop system, because ExtraHop observes all traffic between devices on the wire. Most ExtraHop security detections can be generated from node-level traffic monitoring; however, if you want to monitor traffic between Kubernetes pods for added visibility, you must enable packet forwarding in your Kubernetes cluster. This guide shows you how to deploy a DaemonSet service that configures packet forwarding for each pod in your cluster with the rpcapd software tap.
In addition to configuring packet forwarding, the DaemonSet also deduplicates packets that would otherwise be forwarded multiple times to the ExtraHop sensor.
Before you begin
- Your Kubernetes control plane must be configured on a Linux machine.
Retrieve subnets for Kubernetes pods and services
Before you can configure ExtraHop to monitor Kubernetes pods, you must retrieve the subnets that are allocated to those pods and to the Kubernetes services the pods support.
Important: | Note the subnets you retrieve; you will need the subnets in the deployment procedure. |
Configure the ExtraHop system to discover pods
With L2 discovery, the ExtraHop system assigns all IP addresses to an associated L2 device; this is the default setting for ExtraHop systems. If L2 discovery is enabled, you must configure the ExtraHop system to discover Kubernetes pods as remote devices, even if the pods are located on nodes inside your local network. Otherwise, the pod IP addresses will only be associated with the corresponding L2 devices for the Kubernetes nodes, and the system will not track the pods as separate devices.
Create the rpcapd container image
Create a container image for the containers that will forward packets to the ExtraHop system.
Note: | The following instructions show you how to create the container image with Docker. However, you can create the image with any tool that produces Open Container Initiative (OCI) compliant images. |
Thank you for your feedback. Can we contact you to ask follow up questions?