Views:

Container Security supports protection on connected Amazon EKS and Amazon EKS Fargate containers.

Important
Important

Procedure

  1. Go to Cloud Security → Container Security → Container Inventory.
  2. Select the Amazon EKS node in the tree.
  3. Click Add Cluster.
    The Protect Cluster screen appears.
  4. Specify a unique name for the cluster to appear in the Container Inventory table in the Cluster field.
    • Cluster names must not contain spaces and only support alphanumeric characters, underscores (_), and periods (.).
    • You cannot modify the cluster name after creating the cluster.
  5. If you want to provide more details about the purpose of the cluster, use the Description field.
  6. If you want Container Security to send data to Cloud Posture and receive ASRM Risk Insights, select Map to cloud account.
    1. In the dropdown menu, select AWS.
    2. In another browser tab, sign in to the AWS account that hosts the cluster.
    3. Search for and go to the Amazon Elastic Kubernetes Service settings in AWS.
    4. Click the cluster name you want to protect with Container Security.
    5. Click Overview and copy the ARN value for the cluster.
    6. Back in the Container Security Protect Cluster screen, paste the value in the ARN field.
  7. If you have already created a policy that you want to use to protect the Kubernetes cluster, select the policy name from the Policy dropdown menu.
    You can create a Kubernetes policy and assign the policy after connecting the cluster.
  8. To ensure that Container Security does not impact any of the following Kubernetes management systems, select the systems in the Namespace Exclusions dropdown menu.
    • Calico System
    • Istio System
    • Kube System
    • OpenShift*
    • GKE System*
    Note
    Note
    Options with an asterisk (*) represent sets of related namespaces. For details, see Grouped namespaces.
  9. If your cluster requires a proxy server, turn on Use Proxy and configure the following settings:
    • Protocol: Select HTTP or SOCKS5.
    • Proxy address: Specify the IP address of the proxy server.
    • Port: Specify the port number of the proxy server.
    • Require authentication credentials: Select and specify the Account and Password of the proxy server.
  10. If you already know the type of security features you want to enable on the cluster, turn on the desired features.
    • Runtime Security: Provides visibility into any activity of your running containers that violates a customizable set of rules.
    • Runtime Vulnerability Scanning: Provides visibility of operating system and open source code vulnerabilities that are part of containers running in clusters.
    • Runtime Malware Scanning: Provides detection of malware in your running containers, enabling you to identify and respond to malware threats introduced after deployment.
  11. Click Next.
    The Helm deployment script information appears on the screen.
  12. For users deploying Container Security protection the cluster for the first time:
    1. If you are deploying protection to a Fargate container, select Fargate environment to inject the following code in the Helm script:
      fargateInjector:
        enabled: true
      Note
      Note
      • Before connecting an Amazon EKS Fargate pod, ensure that the container meets the necessary system requirements for EKS Fargate deployments.
      • For pure Amazon EKS Fargate environments, you may need to adjust your Fargate profile to allow the scheduling of pods in a non-default namespace (for example, trendmicro-system). See AWS documentation for more information on Fargate profiles.
    2. To define the configuration properties of Container Security in your Kubernetes cluster, create a YAML file (for example: overrides.yaml) and copy the contents of the first input field to the file.
      WARNING
      WARNING
      The YAML file contains a unique API key required to connect the specified cluster to Container Security. The API key only appears one time and you should create a copy for future upgrades. Trend Micro cannot retrieve the API key again once you close the screen.
    3. To enable automated cluster registration, create an API key and enter true for clusterRegistrationKey, as shown in the example below.
      Note
      Note
      You can configure the protection of the cluster by specifying clusterName, clusterNamePrefix, policyId, groupId under the policyOperator section.
      Sample override file: 
      cloudOne:
    clusterRegistrationKey: true
    endpoint: https://container.us-1.dev-cloudone.trendmicro.com
    exclusion: 
        namespaces: [kube-system]
    inventoryCollection:
        enabled: true
    complianceScan:
        enabled: false
    policyOperator:
        clusterName: xxxx (optional. A random name will be used if not specified)
        clusterNamePrefix: xxxx (optional)
        policyId: xxxx (optional)
        groupId: xxxx (required)
    4. Copy the entire helm install script in the second input field and execute the Helm script on your cluster.
      Note
      Note
      Modify the --values overrides.yaml \ parameter to use the relative path to the overrides.yaml you saved in the previous step.
  13. For users that are updating an existing deployment, copy the entire helm get values --namespace trendmicro-system trendmicro | helm upgrade \ script in the last input field and execute the Helm script on your cluster.
    Note
    Note
    In the future, you can upgrade the helm deployment without overriding changes by using the Helm argument:
    --reuse-values.
Related information