Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Kubernetes - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="kubernetes-jupiterone-integration-benefits">Kubernetes + JupiterOne Integration Benefits</h2> <ul><li>Visualize Kubernetes resources in the JupiterOne graph.</li> <li>Monitor changes using JupiterOne alerts.</li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li><p>When the docker image runs it will fetches resources from Kubernetes to update<br> the graph.</p></li> <li><p>Write JupiterOne queries to review and monitor updates to the graph.</p></li> <li>Configure alerts to take action when JupiterOne graph changes.</li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li>A running Kubernetes cluster. This integration will be deployed as a pod and<br> interact with Kubernetes API server.</li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Kubernetes</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button.</li> <li>Enter the <strong>Account Name</strong> by which you'd like to identify this Kubernetes<br> account in JupiterOne. Ingested entities will have this value stored in<br><code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</li> <li>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</li> <li>Click <strong>Create Configuration</strong> once all values are provided.</li> <li>On the <strong>Configuration Settings</strong> page click <strong>CREATE</strong> next to <strong>Integration<br> API Keys</strong>.</li> <li>Follow the prompts to create the <strong>Integration API Key</strong>, click <strong>REVEAL</strong>,<br> make note of the API Key.</li> <li>Below you will need to decide how you install the Kubernetes integration in<br> your cluster. As part of the installation you will need: <ul><li>The <strong>Integration API Key</strong> you just created</li> <li>The <strong>Integration Instance Id</strong> (which is listed as ID in the<br><strong>Configuration Settings</strong>)</li> <li>Your <strong>Account Id</strong> (listed under <strong>Account Management</strong> after clicking the<br><strong>Gear Icon</strong>).</li> </ul></li> </ol><h3 data-id="in-kubernetes-via-helm">In Kubernetes Via Helm</h3> <p>The easiest way to install and update the <code class="code codeInline" spellcheck="false" tabindex="0">graph-kubernetes</code> project is through<br> the published helm chart. You can find information on how to install our<br> repository <a rel="nofollow" href="https://github.com/JupiterOne/helm-charts">here</a> with specific<br> information about maintain the graph-kubernetes chart<br><a rel="nofollow" href="https://github.com/JupiterOne/helm-charts/tree/main/charts/graph-kubernetes">here</a>.</p> <h4 data-id="quickstart">Quickstart</h4> <pre class="code codeBlock" spellcheck="false" tabindex="0">helm repo add jupiterone https://jupiterone.github.io/helm-charts helm repo update helm install [RELEASE_NAME] jupiterone/graph-kubernetes --set secrets.jupiteroneAccountId="some-account-id" --set secrets.jupiteroneApiKey="some-api-key" --set secrets.jupiteroneIntegrationInstanceId="some-integration-instance-id" </pre> <h3 data-id="in-kubernetes-via-standard-yaml">In Kubernetes Via Standard YAML</h3> <h4 data-id="authentication">Authentication</h4> <h5 data-id="rbac">RBAC</h5> <p>This integration expects a service account with either specific namespace<br> read-only access or cluster-wide read-only access.</p> <h4 data-id="creating-service-account-with-namespace-read-only-access">Creating service account with namespace read-only access</h4> <ol><li>Create a new service account</li> </ol><p><code class="code codeInline" spellcheck="false" tabindex="0">kubectl create sa jupiterone-integration</code></p> <ol start="2"><li>Assign namespace read-only access</li> </ol><p><code class="code codeInline" spellcheck="false" tabindex="0">kubectl create rolebinding jupiterone-integration-view --clusterrole=view --serviceaccount=default:jupiterone-integration --namespace=default</code></p> <h4 data-id="creating-service-account-with-cluster-wide-read-only-access">Creating service account with cluster-wide read-only access</h4> <ol><li>Create a new service account</li> </ol><p><code class="code codeInline" spellcheck="false" tabindex="0">kubectl create sa jupiterone-integration-cluster</code></p> <ol start="2"><li>Assign cluster-wide read-only access</li> </ol><p><code class="code codeInline" spellcheck="false" tabindex="0">kubectl apply -f clusterRole.yml</code></p> <p><code class="code codeInline" spellcheck="false" tabindex="0">kubectl apply -f clusterRoleBinding.yml</code></p> <p>If using a different service account name or different namespace name, make sure<br> to use the correct name in both the commands/yaml listed above.</p> <h4 data-id="secrets">Secrets</h4> <p>The integration requires you to store <code class="code codeInline" spellcheck="false" tabindex="0">jupiterone account id</code>,<br><code class="code codeInline" spellcheck="false" tabindex="0">jupiterone api key</code> and <code class="code codeInline" spellcheck="false" tabindex="0">integration id</code> as secrets that will be read by the<br> pod.</p> <ol><li>Update the <code class="code codeInline" spellcheck="false" tabindex="0">createSecret.yml</code> with base64 encoded values.</li> <li><code class="code codeInline" spellcheck="false" tabindex="0">kubectl apply -f createSecret.yml</code></li> </ol><h4 data-id="deploying">Deploying</h4> <p>To deploy the built image as a pod:</p> <p>a) To create cronjob deployment for a service account with namespace read-only<br> access <code class="code codeInline" spellcheck="false" tabindex="0">kubectl apply -f cronjobNamespace.yml</code></p> <p>b) To create deployment for a service account with entire cluster read-only<br> access <code class="code codeInline" spellcheck="false" tabindex="0">kubectl apply -f cronjobCluster.yml</code></p> <h4 data-id="debugging">Debugging</h4> <pre class="code codeBlock" spellcheck="false" tabindex="0"># To check if the cronjob has been created kubectl get cronjob # To check if the cronjob has spawned any jobs kubectl get job # To see the logs kubectl logs --selector job-name=job-name </pre> <h4 data-id="uninstall">Uninstall</h4> <pre class="code codeBlock" spellcheck="false" tabindex="0"># Delete the deployment kubectl delete cronjob <name> # Delete the service account kubectl delete serviceaccount <serviceaccount> -n <namespace> # Delete the cluster role binding kubectl delete clusterrolebinding <clusterrolebinding> # Delete the cluster role binding kubectl delete clusterole <clusterrole> </pre> <h4 data-id="upgrading">Upgrading</h4> <p>To upgrade a particular resource (cronjob, secrets, etc) all you need to do is<br> reapply the yaml:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">kubectl apply -f resourceFile.yaml </pre> <h2 data-id="advanced-usage">Advanced Usage</h2> <h3 data-id="telemetry-and-diagnostics">Telemetry and Diagnostics</h3> <p>The Helm charts and vanilla Kubernetes yaml are instrumented with the<br><a rel="nofollow" href="https://opentelemetry.io/docs/collector/getting-started/">OpenTelemetry Collector</a><br> and <a rel="nofollow" href="https://docs.fluentbit.io/manual/">FluentBit</a> with FluentBit forwarding<br> docker logs into the OpenTelemetry Collector. If you'd like to forward the same<br> telemetry to your own internal systems (CloudWatch, Prometheus, etc)<br><a rel="nofollow" href="https://opentelemetry.io/docs/collector/configuration/">configure</a> the<br> collector to point to them and update the manifests.</p> <p>For detailed information on installing the Kubernetes install</p> <h1 data-id="how-to-uninstall">How to Uninstall</h1> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Kubernetes</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entities are created:</p> <table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Kubernetes Cluster</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Cluster</code></td> </tr><tr><td>Kubernetes Cluster Role</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster_role</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">AccessRole</code></td> </tr><tr><td>Kubernetes Cluster Role Binding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster_role_binding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> </tr><tr><td>Kubernetes ConfigMap</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_config_map</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>Kubernetes Container Spec</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_container_spec</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>Kubernetes CronJob</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cron_job</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Task</code></td> </tr><tr><td>Kubernetes DaemonSet</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_daemon_set</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Deployment</code></td> </tr><tr><td>Kubernetes Deployment</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_deployment</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Deployment</code></td> </tr><tr><td>Kubernetes Job</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_job</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Task</code></td> </tr><tr><td>Kubernetes Namespace</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Group</code></td> </tr><tr><td>Kubernetes Network Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_network_policy</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>Kubernetes Node</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_node</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Host</code></td> </tr><tr><td>Kubernetes Pod Security Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_pod_security_policy</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>Kubernetes ReplicaSet</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_replica_set</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Deployment</code></td> </tr><tr><td>Kubernetes Role</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_role</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">AccessRole</code></td> </tr><tr><td>Kubernetes Role Binding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_role_binding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> </tr><tr><td>Kubernetes Secret</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_secret</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Vault</code></td> </tr><tr><td>Kubernetes Service</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_service</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td>Kubernetes Service Account</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_service_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr><tr><td>Kubernetes StatefulSet</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_stateful_set</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Deployment</code></td> </tr><tr><td>Kubernetes User</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr><tr><td>Kubernetes Volume</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_volume</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Disk</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster_role_binding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_pod_security_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_kubernetes_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cluster</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_container_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_container_spec</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_volume</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cron_job</code></td> <td><strong>MANAGES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_job</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_deployment</code></td> <td><strong>MANAGES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_replica_set</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_deployment</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_container_spec</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_config_map</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_cron_job</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_daemon_set</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_deployment</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_job</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_network_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_replica_set</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_role_binding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_secret</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_service</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_service_account</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_namespace</code></td> <td><strong>CONTAINS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_stateful_set</code></td> </tr></tbody></table> </article> </main>
.png)