Secure Kubernetes Gateway

• Go to Site Type Selection section` and perform the following:
  • Select a region in the AWS Region drop-down field. This example selects us-east-2.
  • Select New VPC Parameters for the VPC field. Enter a name in the AWS VPC Name field or enter Autogenerate VPC Name.
  • Enter the CIDR in the Primary IPv4 CIDR blocks field.
  • Select Ingress/Egress Gateway (Two Interface) for the Select Ingress Gateway or Ingress/Egress Gateway field.

• Select Configure to open the two-interface node configuration wizard.

• Select Add Item and enter the configuration using the following guidelines.

  • Select an option for the AWS AZ name field that matches the configured AWS Region.
  • Select New Subnet for the Workload Subnet field in the Workload Subnet section. Enter a subnet address in the IPv4 Subnet field.
  • Similarly configure a subnet address for the Subnet for Outside Interface section.
  • Select Apply to complete the two-interface node configuration.

• Go to Site Network Firewall section and select Active Firewall Policies for the Manage Firewall Policy field. Use the Firewall Policy drop-down menu to select Add Item. Enter the configuration using the following guidelines:

  • Enter a name and enter a CIDR for the IPv4 Prefix List field. This CIDR should be within the CIDR block of the VPC.

• Select Configure under Ingress Rules in the Connections To Policy Endpoints section.
• Select `Add Item' to add an ingress rule, and enter the following configuration:
  • Enter a name for the Rule Name field and select Allow for the Action field.
  • Select Any Endpoint for the Select Other Endpoint field.
  • Select Match Protocol and Port Ranges for the Select Type of Traffic to Match field.
  • Select TCP for the Protocol field.
  • Select Add item under List of Port Ranges, and then enter a port range.
  • Select the Apply button at the bottom to save the ingress rule, and then select Apply to complete the ingress rules configuration.

• Select Configure under Egress Rules in the Connections From Policy Endpoints section.
• Select Add Item to add an egress rule to the Egress Rules list, and enter the following configuration:
  • Enter a name for the Rule Name field and select Deny for the Action field. This example configures a deny rule for Google DNS query traffic.
  • Select IPv4 Prefix List for the Select Other Endpoint field and enter 8.8.4.4/32 for the IPv4 Prefix List field.
  • Select Match Application Traffic for the Select Type of Traffic to Match field.
  • Select DNS for the Application Protocols field.
  • Select the Apply button at the bottom to save the egress rule.

• Select Add item and configure another rule of type allow for the endpoint prefix 8.8.8.8/32. This is another Google DNS endpoint prefix.
  • Select Match Application Traffic for the Select Type of Traffic to Match field.
  • Select DNS for the Application Protocols field.
  • Select the Apply button at the bottom to save the egress rule.
• Select Add item and configure another rule with Allow action to allow rest of all egress TCP traffic. Select the Apply button at the bottom to save the egress rule.

• Select Apply to save the egress rules list.

• Select Continue to apply the network policy configuration.

• Select Enable Forward Proxy and Mange Policies for the Manage Forward Proxy Policy field. Use the Forward Proxy Policies drop-down menu to select Add Item. Enter the configuration using the following guidelines:

  • Enter a name and select All Forward Proxies on Site for the Select Forward Proxy field.
  • Select Allowed connections for the Select Policy Rules section.
  • Select Add Item under the TLS Domains field. Select Exact Value from the drop-down list of the Enter Domain field and enter gitlab.com for the Exact Value field. Select Apply to add this domain to the TLS Domains list. Repeat this step several times using the following specifics:
  • Repeat the step above for github.com.
  • Repeat the step again for each of the following domains with the Suffix Value type.
    • gcr.io
    • storage.googleapis.com
    • docker.io
    • docker.com
    • amazonaws.com

Note: The Allowed connections option allows the configured TLS domains and HTTP URLs. Everything else is denied.

• Select Continue to apply the forward proxy policy configuration.

• Enable Show Advanced Fields in the Advanced Options section.
• Select Manage Static Routes for the Manage Static Routes for Inside Network field, and then select Add Item to add a route to the List of Static Routes.
  • Select Simple Static Route for the Static Route Config Mode field.
  • Enter a route for your EKS subnet in the Simple Static Route field.
  • Select Add Item to save the route to the list.

• Select Apply to return to the Ingress/Egress Gateway configuration.
• Select Apply to return to the AWS VPC site configuration screen.

• Select Automatic Deployment for the Select Automatic or Assisted Deployment field.
• Select the AWS credentials created in Step 1.1 for the Automatic Deployment field.
• Select an instance type for the node for the AWS Instance Type for Node field in the Site Node Parameters section.
• Enter your public SSH key in the Public SSH key field. This is required to access the site once it is deployed.

• Select Save and Exit to complete creating the AWS VPC object. The AWS VPC site object gets displayed.

In a new empty directory, create a Terraform file with .tfvars extension and populate it using JSON with the following values:

          {
	"aws_access_key": "foobar",
	"aws_secret_key": "foobar",
	"name": "<vpc_object_name>",
	"vpc_id": "<vpc_id>"
}

        

Note: The values in the file should match those used in the previous steps:

• For AWS access and secret keys, use the same values that you used in steps 1.1 and 1.2.
• For name, use the VPC object name you used in step 1.4.
• For VPC ID, use the value you copied in step 1.5.

If the namespace has already been created on the EKS site, then add "create_namespace": 0:

          {
	"aws_access_key": "foobar",
	"aws_secret_key": "foobar",
	"name": "<vpc_object_name>",
	"vpc_id": "<vpc_id>"
	"create_namespace": 0
}

        

Set the $ACTION environmental variable to apply (note the $ACTION value can be plan, apply or destroy):

          export ACTION=plan

        

Run the following command to deploy the EKS cluster:

          docker run --rm -it \
	--env AWS_ACCESS_KEY_ID=\$AWS_ACCESS_KEY_ID \
	--env AWS_SECRET_ACCESS_KEY=\$AWS_SECRET_ACCESS_KEY \
	--env VAR_FILE_NAME=test.json \
	-v \${PWD}:/terraform/templates/ \
	gcr.io/solutions-team-280017/eks_only \
	/terraform/templates/\$ACTION

        

• Enter a name for your load balancer in the metadata section.
• Enter a domain name in the Domains field. Ensure that its sub-domain is delegated to Distributed Cloud Services. This example sets skg.quickstart.distribugteappsonvolt.org domain. The skg part is a prefix and the quickstart.distribugteappsonvolt.org part is a domain delegated that is already setup on this tenant.
• Select HTTPS with Automatic Certificate for the Load Balancer Type field.

• Select Add Item in the Origins section.

• Use the Origin Pool pull-down to select Add Item.

• In the pool creation form, enter a name for your pool in the metadata section.

• In the Origin Servers section, select Add Item, Select K8s Service Name of Origin Server on given Sites,

• In the Select Type of Origin Server field of Basic Configuration section, select k8s Service Name of Origin Server on given Sites.

  • Enter service name in the <servivename.k8s-namespace> format for the Service Name field. This example sets frontend.hipster as the service name.
  • Select Site for the Site or Virtual Site field and select the site you created in Step 1.
  • Select Inside Network for the Select Network on the site field.
  • Select Apply to save the origin server.

  

• Enter 80 in the Port field.

• Select Continue to save the origin pool.

• Select Apply to add the origin pool to the load balancer.

Scroll down and select Save and Exit to create load balancer. The load balancer object gets displayed with TLS Info field value as DNS Domain Verification. Wait for it to change to Certificate Valid.

The load balancer is now ready, and you can verify it by accessing the domain URL from a browser.