Cilium CNI rules and exceptions for agent installation

If you are using Cilium CNI, consider the following when installing node-agents:

• When using Cilium CNI, consider that Kaspersky Container Security does not automatically detect the orchestration platform (for example, OpenShift). You need to explicitly specify the platform you use in the configuration file using the environment variable PLATFORM_TYPE. This variable can have the following values:
  • k8s (Kubernetes, a default value)
  • openshift
  • shturval

  Depending on the value of this parameter, Kaspersky Container Security applies standard rules for DNS servers for the specified platform in Cilium.

• When using OpenShift or Deckhouse and Cilium CNI, you need to change the internal DNS port. Instead of the default port 53, specify port 5353 in the DNS_PORT variable or a different port that is used in your custom Kubernetes configuration.
• To perform network monitoring and analysis actions when using Cilium CNI, you need to enable the cilium-hubble module. To do this, run the following commands:

  cilium hubble enable <enable the cilium-hubble module>

  cilium status <check whether the cilium-hubble module was enabled correctly>

  To enable the cilium-hubble module correctly, open TCP port 4244 on all nodes that use Cilium CNI.

  For more information on enabling the cilium-hubble module, refer to the Cilium CNI documentation.

Page top