Data protection, Kubernetes, cybersecurity and AI. Hands-on guides from the trenches: Veeam, Kasten, VMware, Oracle, cloud, and whatever I’m breaking in the homelab this week.
Table of ContentsTable of Contents
One of the most widely used cloud-native services are cloud-orchestrated containers. Kubernetes, where public cloud services are one of the most used for this type of workload. In fact, in one of the 2020 cncf.io surveys, it shows us that about 60% of users / companies use cloud-native storage for their containers directly from Google (81%), AWS (80%) and Azure ( 74%), surely these percentages have changed over the years. That is why in this post we will review how to protect all containers in AWS EKS.
The recommended way is to use the integration with an IAM role associated with a service account, in this case, k10-k10, therefore we will start by creating the IAM policies to assign the permissions according to the official configuration of Kasten:
The first link tells us the necessary permissions to take snapshots, restore and migrate between different clusters. In the second link we see all the permissions for each service that access is needed according to what you need to protect. In this case we will see 3 IAM policies to create and have a granularity of permissions to the service account.
We will generate 3 policies, associated to the json that shows us the documentation of KastenFor example, to make the AWS EBS policy we must click on “Create Policy”, click on “JSON” and paste the content:
Then, click on next, to apply tags and then as a last step we will enter the name of the policy:
**Important: The necessary policies must be created, therefore, this step must be repeated, with the policies for the necessary services from the second previous link**
We must use Cloudshell or a local configuration of aws cli, configuring the Authentikation as an administrator user for the management of the following commands.
To have a correct Authentikation, we can configure OIDC in our cluster EKS with the following command (you must enter the name of your cluster):
eksctl utils associate-iam-oidc-provider --cluster NombreCluster --approve
```bash
As stated in the documentation:
https://docs.kasten.io/latest/install/aws/using\_aws\_iam\_roles.html#creating-an-iam-role-for-k10-install
It should be considered that the name of the service account that we will create must be "k10-k10”, the namespace “kasten-io” and also add the ARN of the policies that we generate, to obtain the ARN of the policies, you must enter IAM and click on the name of the policy to see the ARN, we copy each of the ARN of the created policies previously:
Now we will create the namespace “kasten-io”
```bash
kubectl create ns kasten-io
```bash
And then we generate the service account with the following command:
```bash
eksctl create iamserviceaccount \
--name k10-k10 \
--namespace kasten-io \
--cluster Lab-EKS \
--attach-policy-arn arn:aws:iam::123456789000:policy/k10-EBS \
--attach-policy-arn arn:aws:iam::123456789000:policy/k10-RDS \
--attach-policy-arn arn:aws:iam::123456789000:policy/k10-S3 \
--approve \
--override-existing-serviceaccounts
```bash
**\*\*remember to enter the name of the cluster EKS and the RNA of each policy\*\***
After this we will see in IAM, a new Role:
As seen in the previous image, the policies are associated with this new role generated and associated with the service account. We will copy the ARN of the new role and proceed to the installation of Kasten K10
## Installation Kasten K10 AWS EKS
As we have seen several times in this blog, we must have "helm" configured with its respective chart, you can see it here:
> [Veeam + Kasten](/en/veeam-kasten/)
/veeam-kasten/embed/#?secret=KfxpkOJaRX#?secret=hRCMNgXjyM
And now we will install Kasten K10 with the following command:
```bash
helm install k10 kasten/k10 --namespace=kasten-io --set secrets.awsIamRole="arn:aws:iam::123456789000:role/eksctl-Lab-EKS-addon-iamserviceaccount-kaste-Role1-12FASDASDCKA"
```bash
**\*Remember that you must enter the ARN of the previously created Role\***
\\*\\* In case you get an error claiming the existence of a service account, just delete and re-create the namespace kasten-io\*\*
We hope that the pods of “kasten-io” remain in the “running” state by checking them with the following command:
```bash
watch kubectl get pods -n kasten-io
```bash
If you want to see the disks that were created automatically with the installation of Kasten K10:
```bash
kubectl get pvc -n kasten-io
```bash
Finally we need access to the console Kasten K10, we just have to execute the following command:
```bash
helm upgrade k10 kasten/k10 --namespace=kasten-io \
--reuse-values \
--set externalGateway.create=true \
--set auth.tokenAuth.enabled=true
```bash
Which will create a "Load Balancer" service and assign an AWS dns address:
```bash
kubectl get svc gateway-ext -n kasten-io
```bash
We only have to enter the url, in this case:
http://a8c57c2bded63432194a6545af3ce024-1753718719.sa-east-1.elb.amazonaws.com/k10/#/
and we will proceed to Authentikate as seen in the official documentation:
https://docs.kasten.io/latest/access/Authentikation.html#obtaining-tokens
So far you can use Kasten K10 to back up your loads on AWS EKS : )
## integrate with K10 Multi-Cluster Manager AWS EKS
We have already seen how to install K10 Multi-Cluster Manager, if you haven't checked it out yet:
> [Kasten RBAC Multi-Tenant Multi-Cluster Keycloak – 1](/en/kasten-rbac-multi-tenant-multi-cluster-keycloak/)
/kasten-rbac-multi-tenant-multi-cluster-keycloak/embed/#?secret=MIlKOe6eZN#?secret=LGzFX95dGH
or install K10 Multi-Cluster Manager without Keycloak:
> [Install Kasten Multi Cluster Manager](/en/install-kasten-multi-cluster-manager/)
/instalar-kasten-multi-cluster-manager/embed/#?secret=JEgxvfjbM1#?secret=oF7QN5V4wF
Now, we have to configure the kubeconfig file in our Multi-Cluster Manager interface, we will try to add the cluster through the web interface, by clicking on “Add Clusters” and we will paste the content of the kubeconfig file of our AWS cluster EKS and it will show us the following:
As we can see, the cluster cannot be selected, since K10MultiCluster needs a previous step to prepare the kubeconfig file correctly, for this we will perform the following command to identify the context of kubernetes used:
```bash
kubectl config get-contexts
```json
We copy the name of the context and then we execute the command:
```text
k10multicluster kubeconfig prepare --context arn:aws:eks:sa-east-1:12345678900:cluster/Lab-EKS
We copy the content after “—” and paste it again in K10 Multi-Cluster Manager in “Add Clusters” and we will see that the options to add the AWS cluster are now enabled EKS:
We select the cluster and pass it to the right, to then enter the “Cluster Display Name”, the “Ingress URL” which is the URL that was assigned to us in the services of kasten-io, always adding as indicated by the interface, namespace “kasten-io”, helm release name “k10” and disable TLS, since we are adding it without TLS, in case you configure access with a certificate, enable it, then click on “Add Clusters”:
And we will have the AWS cluster EKS at our K10 Multi-Cluster Manager configured to apply the necessary policies.
As previously we configured all the permissions associated with a service account of kasten k10 and the policies associated with the role created, when we configure a “Location Profile” we can use the same IAM Role for Authentikation by selecting:
We enter the Region, Bucket Name and save the profile, of course if the bucket has immutability enabled you can also use it.
I always recommend things at the security level, always only allow the IP’s authorized to access the services of kasten, through firewall rules to preserve privacy, on the other hand, if it is necessary to generate more permissions to the role, you should only generate the necessary policy, such as to support with the necessary permissions of RDS and associate it to the generated role.
