Channels
#neuvector-security
- f
full-lawyer-94872
03/02/2023, 6:45 AMAnd one strange thing that I noticed was that some network connections kept on adding into the allow list even while it was on monitor mode which I did not expect. I did not test this yet in protect mode, but could that be a bug or is that expected in some scenarios? - q
quiet-fountain-46593
03/02/2023, 3:53 PM2 ways that can happen. 1st if they are added manually. They would should as “User Created” and not “Learned”. Second possibility is if it is between 2 pods, and one of them is still in discover. - f
full-lawyer-94872
03/03/2023, 12:38 AMPerfect! This was in fact the 2nd scenario where the 2nd pod in the rule was from another group which was still in discover mode. - f
full-lawyer-94872
03/03/2023, 2:37 PMAnd, talking about network tracing, this is another curious thing that I came across in the network graph. - f
full-lawyer-94872
03/03/2023, 2:37 PMScreenshot 2023-03-03 at 15.03.54.png - f
full-lawyer-94872
03/03/2023, 2:38 PMsome unknown containers and node instances which NeuVector identifies asunmanaged - f
full-lawyer-94872
03/03/2023, 2:39 PMand I did check the cluster using kubectl and could not find any pod or node that carries the mentioned ips. - f
full-lawyer-94872
03/03/2023, 2:40 PMWhat exactly could be this identification in the network graph ? - q
quiet-fountain-46593
03/03/2023, 2:44 PMusually that is due to traffic from a node that doesn’t have an enforcer running. sometimes it is control plane nodes with a taint so the daemonset does not schedule there. other times it can be due to a cni or service mesh issue, if they have tunnels or other interfaces that neuvector is not aware of - f
full-lawyer-94872
03/03/2023, 3:55 PMWell, IPs of these instances do not match with any pod IP or worker node IP. Hence we can rule out it being a cni or service mesh issue, right? - f
full-lawyer-94872
03/03/2023, 4:09 PMAlso what is your guess about those container instances? They too do not match with any pod IP. - q
quiet-fountain-46593
03/03/2023, 4:26 PMsometimes there are tunnel interfaces that have rfc1918 IPs. so not a pod, and not the node ip. if this is in cloud, could be something related to that, though I haven’t noticed this type of thing in gke/eks/aks - f
full-lawyer-94872
03/03/2023, 4:27 PMThis is in fact AKS 🙂 - q
quiet-fountain-46593
03/03/2023, 4:29 PMusually NV handles the control plane components of the cloud k8s providers nicely. Could be some case here where that is not happening. Is this a mostly default AKS cluster? - f
full-lawyer-94872
03/03/2023, 4:34 PMyes, but private - f
full-lawyer-94872
03/03/2023, 4:41 PMThere seems to be some worker nodes with taints and where enforcer is not installed. Still no match with those IPs. - f
full-lawyer-94872
03/03/2023, 4:42 PMSo these unmanaged nodes happen to be totally outside the worker node pool. - f
full-lawyer-94872
03/03/2023, 4:50 PMBut still all IPs are in 172.18.x.x private range, so not external either - q
quiet-fountain-46593
03/03/2023, 5:00 PMis a single /16 cidr?f- 2
- 1
- q
quiet-fountain-46593
03/03/2023, 5:17 PMor if smaller, are there things on the same network that are not part of the cluster?f- 2
- 1
- q
quiet-fountain-46593
03/03/2023, 5:25 PMAlso checking to see if there is an age out threshold for short lived pods in the network map.f- 2
- 7
- b
broad-battery-84396
03/03/2023, 6:39 PMI’m looking for more information about the federation features but I can’t find a lot of architecture information. For example, if we are doing a federated NeuVector deployment, should we still deploy the manager pods for all of the clusters?➕ 1 - f
full-lawyer-94872
03/03/2023, 11:15 PMThis is in fact a question that I too have. - f
full-lawyer-94872
03/03/2023, 11:16 PMCurrently, the way I have achieved federation is as follows. - f
full-lawyer-94872
03/03/2023, 11:19 PM[1] Simply deploy the default helm chart in both master and worker clusters and of course I have used a proper ingress for the master - f
full-lawyer-94872
03/03/2023, 11:20 PM[2] Deploy respective master and worker services to establish accessibility among the clusters - f
full-lawyer-94872
03/03/2023, 11:20 PM[3] Manually login to master manager console and promote the cluster as master - f
full-lawyer-94872
03/03/2023, 11:21 PM[4] Manually login to each worker manager console and join federation as a worker - f
full-lawyer-94872
03/03/2023, 11:23 PMafter this, there is no real use of each worker manager console if there is no failure in federation and we do not have to perform a rejoin. - f
full-lawyer-94872
03/03/2023, 11:24 PMReferences: