Container Security supports protection on connected Google GKE containers.
Important
|
Procedure
- Go to .
- Select the Kubernetes node in the tree.
- Click Add Cluster.The Protect Cluster screen appears.
- Specify a unique name for the cluster to appear in the Container Inventory
table in the Cluster field.
Note
-
Cluster names must not contain spaces and only support alphanumeric characters, underscores (_), and periods (.).
-
You cannot modify the cluster name after creating the cluster.
-
- If you want to provide more details about the purpose of the cluster, use the Description field.
- If you want Container Security to send data to Cloud Posture and receive ASRM Risk Insights, select Map to cloud
account.
- In the drop-down, select GCP.
- In another browser tab, sign in to the Google Cloud account that hosts
the cluster and copy the following values into the Container Security -
Protect Cluster screen.
-
Project ID: Go to {project_id} and copy the Project ID.
-
GCP "Cluster region": Go toand copy the Cluster region.
-
GCP "Cluster name": Go toand copy the Cluster name.
-
- If you have already created a policy that you want to use to protect the
Kubernetes cluster, select the policy name from the
Policy drop-down.You can create a Kubernetes policy and assign the policy after connecting the cluster.
- To ensure that Container Security does not impact any of the following
Kubernetes management systems, select the systems in the Namespace
Exclusions drop-down.
-
Calico System
-
Istio System
-
Kube System
-
OpenShift
-
- If your cluster requires a proxy server, turn on Use
Proxy and configure the following settings:
-
Protocol: Select HTTP or SOCKS5.
-
Proxy address: Specify the IP address of the proxy server.
-
Port: Specify the port number of the proxy server.
-
Require authentication credentials: Select and specify the Account and Password of the proxy server.
-
- If you already know the type of security features you want to enable on the
cluster, turn on the desired features.
-
Runtime Security: Provides visibility into any activity of your running containers that violates a customizable set of rules.
-
Runtime Vulnerability Scanning: Provides visibility of operating system and open source code vulnerabilities that are part of containers running in clusters.
-
Runtime Malware Scanning: Provides detection of malware in your running containers, enabling you to identify and respond to malware threats introduced after deployment.
-
- Click Next.The Helm deployment script information appears on the screen.
- For users deploying Container Security protection for the first time:
- To define the configuration properties of Container Security in your
Kubernetes cluster, create a YAML file (for example:
overrides.yaml) and copy the contents of the
first input field to the file.
WARNING
The YAML file contains a unique API key required to connect the specified cluster to Container Security. The API key only appears one time and you should create a copy for future upgrades. Trend Micro cannot retrieve the API key again once you close the screen. - To enable automated cluster registration, create an API key and enter
true
forclusterRegistrationKey
, as shown in the example below.Note
You can configure the protection of the cluster by specifyingclusterName
,clusterNamePrefix
,policyId
,groupId
under thepolicyOperator
section.Sample override file:cloudOne: clusterRegistrationKey: true endpoint: https://container.us-1.dev-cloudone.trendmicro.com exclusion: namespaces: [kube-system] inventoryCollection: enabled: true complianceScan: enabled: false policyOperator: clusterName: xxxx (optional. A random name will be used if not specified) clusterNamePrefix: xxxx (optional) policyId: xxxx (optional) groupId: xxxx (required)
- Copy the entire
helm install
script in the second input field.Important
- Paste the
helm install
script in an editor and modify the following:-
--values overrides.yaml \
- Use the relative path to the overrides.yaml you saved in the previous step. -
exclusion:
>namespaces
- Ensure that you add the following exclusions to the list: kube-system, gmp-system, autoneg-system
-
- To define the configuration properties of Container Security in your
Kubernetes cluster, create a YAML file (for example:
overrides.yaml) and copy the contents of the
first input field to the file.
- For users that are updating an existing deployment, copy the entire
helm get values --namespace trendmicro-system trendmicro | helm upgrade \
script in the last input field and execute the Helm script on your cluster.Note
In the future, you can upgrade the Helm deployment without overriding changes by using the Helm argument:--reuse-values
.