Ubuntu 18.04
Overview¶
This user journey guides you to install and verify the compatibility of Cilium on Ubuntu 18.04 with 5.4 Kernel Version by applying policies on kubernetes workloads.
Step 1: Install etcd in control plane VM¶
sudo apt-get install etcd
Once etcd installed, configure the following values in /etc/default/etcd as shown below.
ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379
ETCD_ADVERTISE_CLIENT_URLS=http://0.0.0.0:2379
Restart and check the status of etcd:
sudo service etcd restart
sudo service etcd enable
sudo service etcd status
Step 2: Install KVM-Service in control plane¶
Pre-requisites: Download and Install Go
Visit Go Website for Latest Version
wget https://go.dev/dl/go1.18.1.linux-amd64.tar.gz
Untar file:
rm -rf /usr/local/go && tar -C /usr/local -xzf go1.18.1.linux-amd64.tar.gz
vim /etc/profile
Paste the below path in /etc/profile:
export PATH=$PATH:/usr/local/go/bin
Run the following command:
source /etc/profile
Clone KVM-Service code and checkout to non-k8s branch:
sudo git clone https://github.com/kubearmor/kvm-service.git
cd /kvm-service/
sudo git checkout non-k8s
Navigate to kvm-service/src/service/ and execute the following command to compile KVM-Service code:
make
Once compilation is successful, run KVM-Service using the following command:
sudo ./kvmservice --non-k8s 2> /dev/null
Note: Let keep it running and continue in new terminal.
Step 3: Install Karmor in control plane¶
Run the following command to Install Karmor utility:
curl -sfL https://raw.githubusercontent.com/kubearmor/kubearmor-client/main/install.sh | sudo sh -s -- -b /usr/local/bin
Step 4: Onboard VMs using Karmor¶
vim kvmpolicy1.yaml
apiVersion: security.kubearmor.com/v1
kind: KubeArmorVirtualMachine
metadata:
name: testvm1
labels:
name: vm1
vm: true
Run this command:
karmor vm add kvmpolicy1.yaml
When a new VM is onboarded, the KVM-Service assigns a new identity to it. To see the list of onboarded VMs, execute the following command.
karmor vm list
Step 5: Generate Installation scripts for configured VM¶
karmor vm --kvms getscript -v testvm1
Output:
VM installation script copied to testvm1.sh
Step 6: Execute the Installation script in Docker Installed VM¶
Install Docker:
sudo apt-get update
sudo apt install docker.io
sudo systemctl start docker
sudo systemctl enable docker
sudo systemctl status docker
Comment the following line on the script and save it:
vi testvm1
#sudo docker run --name kubearmor $DOCKER_OPTS $KUBEARMOR_IMAGE $KUBEARMOR_OPTS
Execute the Installation script:
Copy the generated installation scripts to appropriate VMs using scp or rsync method and execute the scripts to run Cilium.
The script downloads Cilium Docker images and runs them as containers in each VM. Cilium running in each VM connects to the KVM-Service control plane to register themselves and receive information about other VMs in the cluster, labels, IPs and configured security policies.
Execute the script on worker VM by running the following commands:
sudo su -
chmod 777 testvm1.sh
./testvm1.sh
Note: Make sure the kvm-service is running on control plane VM & To onboard more worker VM repeat Step 6, Step 7 & Step 8.
You can Verify by running following command,
docker ps
Step 7: Apply and Verify Cilium network policy¶
vim port80-allow.yaml
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
name: "vm1-allow-http"
spec:
description: "L4 policy to allow traffic at port 80/TCP"
nodeSelector:
matchLabels:
name: vm1
ingress:
- toPorts:
- ports:
- port: "80"
protocol: TCP
Run this command to apply the policy:
karmor vm --kvms policy add port80-allow.yaml
Note: The policy says.. "ingress, port 80/TCP". This will allow ingress connection to the specified port/protocol. Anything other than that will be denied.
Step 8: Violating the policy¶
Output : Unable to SSH the VM via 22 port
Deleting the applied policy:
karmor vm --kvms policy delete port80-allow.yaml
Output : Now able to do SSH