Kubernetes Gateway deployment

The BlastShield Gateway supports running as a container in a K8s cluster. The image will run on 32-bit arm, 64-bit arm and x86_64. The Gateway addressing mode must use source+destination NAT.

Endpoints must be created on the Gateway for the services that you want to expose over the Blastshield™ network. For example, ClusterIP services can be created as endpoints, but you can expose any service that the container itself can get to, even if the service is outside the cluster. Endpoints will not be able to establish connections out over the BlastShield™ network overlay because there is no route to the overlay network.

Gateway Connectivity Requirements

Outbound UDP ports to all required destinations.
Resolution of DNS requests must be supported by the network.

Configure the Gateway in the Orchestrator and install the image in the Kubernetes cluster

Create a new gateway in the orchestrator and set the mode to "Source + destination NAT".
1. Connect to the Orchestrator and select Gateways from the left Menu.
2. Select Add New Gateway.
3. Enter a name for the new Gateway.
4. Select Addressing Mode for the Gateway to be IP Address (Source+Destination NAT).
5. Select Save and Download Invitation and copy it to the clipboard. Keep the invitation data as you will need it in the next step.
Create a Kubernetes secret containing the invitation:
kubectl create secret generic blastshield-gw --from-literal=invitation=XXXXXX

Apply the provided yaml file (see below).

blastshield-gw.yml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: blastshield-gw
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: blastshield-gw
rules:
  - apiGroups: [""]
    resources:
      - secrets
    verbs:
      - update
    resourceNames:
      - blastshield-gw
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: blastshield-gw
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: blastshield-gw
subjects:
  - kind: ServiceAccount
    name: blastshield-gw
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: blastshield-gw
spec:
  selector:
    matchLabels:
      run: blastshield-gw
  replicas: 1
  template:
    metadata:
      labels:
        run: blastshield-gw
    spec:
      serviceAccountName: blastshield-gw
      volumes:
        - name: data
          secret:
            secretName: blastshield-gw
      containers:
        - name: blastshield-gw
          image: public.ecr.aws/blastwave/blastshield-gw:1.7
          imagePullPolicy: Always
          env:
            - name: K8S_SECRET
              value: blastshield-gw
          volumeMounts:
            - name: data
              mountPath: "/data"
          securityContext:
            capabilities:
              add: ["NET_ADMIN"]
      securityContext:
        sysctls:
          - name: net.ipv4.ip_local_port_range
            value: 16384 32767

Create endpoints for the services that you want to expose over the blastshield network. You can use the IP address or the DNS name of the service (such as service.namespace.svc.cluster.local) as the destination.
Services that you can create as endpoints are:
1. ClusterIP services
2. Other services which the container itself can get to, even services outside the cluster.

To learn how to add endpoints to the Gateway, please read the following section.

Create Endpoints on the Gateway

For each of the devices that you want to securely access via the BlastShield™ Gateway, you must create a corresponding Endpoint for it on the Gateway.

Follow this procedure to learn how to create an Endpoint on the Gateway.

In the Orchestrator, select the Gateway and click on the Endpoints tab.
Click the 'Add New Endpoint' button and click on the 'Endpoint Enabled' button.
Enter a name for the Endpoint in the Name field.
In the DNS Hostname field, enter a hostname.
In the Destination field, enter the device's Private IPv4 address or hostname.
For a Gateway using Destination NAT addressing mode, If you want the endpoint to be able to communicate out through the Gateway (e.g. for transferring log files or making software updates) then check the box marked Allow outbound external network connectivity. If you are using a Gateway in Source + Destination NAT you can skip this step.
Click on 'Save Changes'.
The status of the Endpoint will show as 'Online'.
For endpoints on Gateways which use destination NAT addressing mode only, modify the endpoint's route table so that the endpoint may connect out over the BlastShield™ network. If you are using a Gateway which is set to Source + Destination NAT you can skip this step.

Configure an access policy and microsegmentation groups

About Groups

Groups allow you to micro-segment users and endpoints. A group is a logical collection of endpoints and/or users that are grouped together. Groups are connected via policies, which form the foundation for BlastShield access control and segmentation management.

Any combination of endpoints and/or users can be grouped together.
There is no limit to the number of endpoints and/or users that can be in a group.
Endpoints and users can be in one or multiple groups simultaneously.
Groups are linked together via policies to provide access between endpoints.
By default, endpoints/users cannot access or have visibility to other endpoints/users unless they are granted access via a policy

About Policies

A policy defines how groups can interact. Groups are connected via policies, which form the foundation for BlastShield access control and segmentation management.

Each policy will have two sets of groups - "From" and "To".
The "From" set is one or more source groups.
The "To" set is one or more destination groups.
There is no limit to the number of groups in a given policy.
"From" Groups will have access to "To" Groups within the policy.
"To" Groups will not have access to "From" Groups within the policy.
Groups can be in one or multiple policies simultaneously.

Create Groups

From the Orchestrator, select "Groups" from the left menu.
Select "Add New Group" from the Group List.
Enter a name for the new Group.
To add members to the new group, click the "Add Members" button.
1. If you adding users to the group then select the desired Users which you want to be associated with the Group from the "Users" box.
2. If you are adding Agents to the group then select the desired Agents which you want to be associated with the Group from the "Agents" box.
3. If you are adding Gateway Endpoints then select the desired Endpoints from the "Endpoints" box.
4. Alternatively, you can leave the members list empty and add/modify new members later.
Click "Add Members" to save the members.
Click "Save" to save the new group.
Repeat, if required, to ensure you have one group for your endpoints and one group for your users, which is the minimum you will need in order to define the access policy.

Please refer to the following video, which is an example of creating one group for your users and one group for Host Agents.

Create a Policy to link your Groups

To connect your user groups and protected servers groups, you must link them with a policy as described here:

Note

Users and Agents must be a member of a group for them to be used in a policy.

Select "Policies" from the left menu.
Select "Add New Policy" from the Policy List.
Enter a name for the new Policy.
Select desired "From" Groups to be associated with the new Policy.
Select desired "To" Groups to be associated with the new Policy.
Save the new Policy.

Policies are directional, so that you can control the direction in which connections may be initiated. Typically for remote access use-cases your policy would be from the "user group" to the "server group" so that users may start connections to the servers, but servers cannot start connections to users. You can create bi-directional permissions by using two policies.

The following video shows an example of creating an access Policy between a group of remote workers and a group of servers. The policy gives the remote workers authorisation to access the server group.

Upgrading the Gateway.

When running as a container, the Gateway must be upgraded by modifying the container to use a newer image.

In this section:

BlastShield Documentation