Network rules are not working on GKE about kubearmor HOT 5 CLOSED

@sublimino cilium and kubearmor have different views.
what I mean is that we're not talking about security rules for inter-container communications.
instead, we're talking about the networking capability of processes inside of containers.

from kubearmor.

FYI Dataplane v2 (Cillium) will become standard on GKE but is a little different to stand up https://cloud.google.com/kubernetes-engine/docs/how-to/dataplane-v2?hl=it#create-cluster

from kubearmor.

The AppArmor provided by GKE currently doesn't support network rules.
Therefore, if we want to block ICMP, we need to block the NET_RAW capability instead of ICMP.
In the case of TCP and UDP, there is no way to control such networking operations on GKE.

from kubearmor.

For the network rules on GKE, we can replace the Block action with the Audit action.
So, if we want to block the TCP connection in the pods with the key=value label,
KubeArmor enforces the corresponding rule into the nodes on GKE by replacing the actions like "Block" -> "Block (Audit)".
Of course, this replacement should happen on GKE only. In other environments, we keep original actions.

from kubearmor.

In the case of GKE, the Block action of KubeArmor's network policies is changed to the Audit action (i.e., "Audit (Block)").

from kubearmor.