Deploy BlueLock on EKS Fargate¶

Overview

Deploy the BlueLock sample on EKS Fargate, onboard the cluster to AccuKnox and block apt in the sample pod. With an existing EKS Fargate cluster, start at Step 2.

Workflow at a Glance¶

What You Deploy Across Three Namespaces¶

Prerequisites¶

Requirement	Used for
AWS CLI and `eksctl`, configured	Creating the cluster and the Fargate profile
`kubectl`, `helm` and `socat`	Deploying the sample, installing the agents and reaching the pod
EKS admin access	Creating namespaces and cluster-level resources
AccuKnox SaaS access	Onboarding the cluster, applying the policy and viewing the alert

Step 1. Create an EKS Fargate Cluster¶

Create the cluster. The command creates a VPC, an EKS cluster, the Fargate profile fp-default for default and kube-system, and a few essential add-ons.

eksctl create cluster \
  --name kubearmor-fargate \
  --region us-east-2 \
  --fargate

Create a Fargate profile for the agents namespace.

eksctl create fargateprofile \
  --cluster kubearmor-fargate \
  --region us-east-2 \
  --name fp-agents \
  --namespace agents

Prefer the AWS console?

You can create the cluster and the profile there. An existing cluster needs Fargate profiles for default, kube-system and agents.

Step 2. Create the Agents Namespace¶

kubectl create ns agents

Pods on Fargate start slowly

AWS starts a separate VM for each pod. Wait and verify after each component.

Helm pulls the agents chart from public ECR.

aws ecr-public get-login-password --region us-east-1 | helm registry login --username AWS --password-stdin public.ecr.aws

Step 4. Deploy the Relay and the Sample Workload¶

Install the KubeArmor Relay in kube-system¶

cat <<EOF | kubectl apply -f -
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubearmor
  namespace: kube-system
---
apiVersion: v1
kind: Service
metadata:
  name: kubearmor
  namespace: kube-system
  labels:
    kubearmor-app: kubearmor-relay
spec:
  selector:
    kubearmor-app: kubearmor-relay
  ports:
  - name: "grpc-port"
    port: 32767
    protocol: TCP
  - name: "http-port"
    port: 2801
    protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kubearmor-relay
  namespace: kube-system
  labels:
    kubearmor-app: kubearmor-relay
spec:
  replicas: 1
  selector:
    matchLabels:
      kubearmor-app: kubearmor-relay
  template:
    metadata:
      labels:
        kubearmor-app: kubearmor-relay
      annotations:
        kubearmor-policy: audited
    spec:
      serviceAccountName: kubearmor
      containers:
      - name: kubearmor-relay-server
        image: docker.io/kubearmor/kubearmor-relay-server:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 32767
        - containerPort: 2801
        resources:
          requests:
            cpu: 250m
            memory: 64Mi
          limits:
            cpu: 500m
            memory: 128Mi
EOF

Install the KubeArmor Policy CRD¶

kubectl create -f https://raw.githubusercontent.com/kubearmor/KubeArmor/refs/heads/main/deployments/CRD/KubeArmorPolicy.yaml

Deploy the Sample BlueLock Workload in default¶

The manifest:

Copies the bluelock binary into a shared emptyDir volume with an init container.
Starts /kubearmor/bluelock first in armored-container, with socat as its arguments.
Points SIDEKICK_URL at the relay on port 2801.

cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: armored-application
  labels:
    deployment: armored-application
spec:
  replicas: 1
  selector:
    matchLabels:
      kubearmor.io/container.name: armored-container
  template:
    metadata:
      labels:
        kubearmor.io/container.name: armored-container
    spec:
      serviceAccountName: kubearmor
      volumes:
        - emptyDir: {}
          name: kubearmor-dir
      initContainers:
        - name: bluelock
          image: public.ecr.aws/k9v9d5v2/accuknox-bluelock:v1.0.0
          imagePullPolicy: Always
          volumeMounts:
            - mountPath: /kubearmor
              name: kubearmor-dir
      containers:
        - name: armored-container
          image: public.ecr.aws/k9v9d5v2/accuknox-bluelock/ka-socat-demo:latest
          imagePullPolicy: Always
          command: ["/kubearmor/bluelock","socat", "TCP-LISTEN:1337,reuseaddr,fork", "EXEC:bash,pty,stderr,setsid,sigint,sane"]
          ports:
            - containerPort: 1337
          volumeMounts:
            - mountPath: /kubearmor
              name: kubearmor-dir
          env:
          - name: "SIDEKICK_URL"
            value: "http://kubearmor.kube-system.svc.cluster.local:2801"

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubearmor-clusterrolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubearmor
  namespace: default
- kind: ServiceAccount
  name: kubearmor
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubearmor
---
EOF

Use the sample in test clusters

The manifest binds the kubearmor service accounts in default and kube-system to cluster-admin. Review it before you reuse it outside a test cluster.

Step 5. Onboard the Cluster to AccuKnox¶

Generate the Helm command as described in Runtime Security Onboarding. Add these two flags to leave KubeArmor out:

--set kubearmor-operator.enabled=false
--set kubearmor-operator.autoDeploy=false

After a few minutes, list the pods.

kubectl get pods -n agents

NAME                                            READY   STATUS        RESTARTS   AGE
agents-operator-558786bbc5-z857l                1/1     Running       0          10m
cis-k8s-job-1779677622-rcq4j                    0/1     Pending       0          10m
discovery-engine-5c757f9fb9-vnk7s               2/2     Running       0          4m7s
feeder-service-5cc8664cd5-mvrfb                 1/1     Running       0          4m8s
k8s-risk-assessment-job-1779677622-vkscr        0/1     Completed     0          10m
kiem-job-1779677622-wrkmp                       0/1     Completed     0          10m
kubearmor-operator-77d98d4f9d-rcgln             1/1     Running       0          10m
kubeshield-controller-manager-7b44cd489-t58kw   0/1     Pending       0          10m
policy-enforcement-agent-b8d49b556-szjjh        1/1     Running       0          4m8s
shared-informer-agent-7859c8f4-2mh99            1/1     Running       0          4m8s

The CIS K8s job and kubeshield-controller-manager stay Pending because Fargate does not support them.

Step 6. Apply the Sample Policy From AccuKnox¶

In AccuKnox, open Runtime Protection, then Policies, and create this policy. It denies apt and apt-get. Activate it after you save.

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: block-pkg-mgmt-tools-exec
spec:
  selector:
    matchLabels:
      kubearmor.io/container.name: armored-container
  process:
    matchPaths:
    - path: /usr/bin/apt
    - path: /usr/bin/apt-get
  action:
    Block

Step 7. Port-Forward to the Sample Pod¶

kubectl port-forward pod/$(kubectl get pods --no-headers | grep armored-application | awk '{print $1}') 1337:1337

Step 8. Connect to the Sample Application¶

In a second terminal:

socat - TCP:localhost:1337

Step 9. Run a Blocked Command and Confirm the Denial¶

In the socat session:

apt -v

You get a permission denied error and an alert in AccuKnox.

Step 10. Delete the Cluster When You Finish¶

eksctl delete cluster \
  --name kubearmor-fargate \
  --region us-east-2