search

elastic / endpoint

Other
29 stars 9 forks source link

Host isolation not working with Daemonset implementation #43

Open xxxmadxxx opened 1 year ago

xxxmadxxx commented 1 year ago

Hi,

I have an Kubernetes cluster that I'm implementing the following manifest: https://raw.githubusercontent.com/elastic/endpoint/main/releases/8.6.0/kubernetes/deploy/elastic-defend.yaml

When I look at my cloud fleet I'm seeing that host isolation is not working. It was supposed to work? If not, why? Maybe with the "why" I can try to solve it here and get a workaround.

Screenshot from 2023-02-22 13-56-30

Screenshot from 2023-02-22 13-57-20

mjwolf commented 1 year ago

Hi, host isolation is not supported with kubernetes. This is because it would have some undesirable behavior in kubernetes.

If you were to isolate a node, all workloads running on that node would become unhealthy, and would be rescheduled on another node. Depending on the nature of the problem you're trying to isolate, the problem could be reintroduced when the pod is restarted on another node.

Also the cluster auto-scaler would likely detect the node is unhealthy, and kill the underlying VM, so it won't be available to un-isolate or use to investigate the problem later.

As a workaround, you could use the kubernetes API, or kubectl, to change things to do something similar to host isolation. Either add NoExecute taint to the node to stop all pods from running on it, modify the network service to make the pods unreachable or change the workload resources to stop pods from running could be ways to isolate or stop problems.

xxxmadxxx commented 1 year ago

Thank you @mjwolf. It's possible to see the documentation or something similar where this behavior is specified? I'd like to understand how this is implemented in the elastic endpoint code to make sure that if I create a workaround I'll be aware of all the things that are happening

nfritts commented 1 year ago

Howdy @xxxmadxxx,

Host Isolation and malware protection being disabled are mentioned in a note on this documentation page at the bottom of the Setup section https://www.elastic.co/guide/en/security/8.6/kubernetes-dashboard.html#k8s-dash-setup

Unfortunately, I'm not sure I have much else to provide you, but we can attempt to answer any other questions that you have.