Setup external firewall network security with kops and aws

Question

At the moment I want to introduce some external firewall solution for kubernetes within the AWS. I'm using kops to help build the production environment. It’s a pretty good framework However, I’m new to the AWS network structure and kubernetes is also a new thing for me. What I want to do is setup a firewall for all requests come to the services within the kubernetes. And if someone hacked a container within the kubernetes, he or she cannot attack any other containers in the cluster. Any idea or suggestion?

Answer 1

For general Kubernetes restricting actions at a network level can be done (assuming you're on 1.7) via Network Policies.

In addition to that if you're concerned about malicious containers in your cluster, I'd recommend reviewing the CIS Kubernetes standard to make sure you've locked down your cluster as, out of the box there appear to be some concerns with kops.

Answer 2

OK I finally figured out a solution. At the beginning, I try to use Fortinet Gate with kops. But it's not working and causing a lot of issues...it seems that the change of route table will have some conflict with kops. Anyway, it's not a good idea to reconnect subnets and firewall instances regarding kops. Later we switched to Deep security. All good. The only issue is kops doesn't support custom launch config at the moment. I hope this can help anyone who want to setup security env on kubernetes.