Skip to main content

Illumio Segmentation for Containers

Agentless Containers overview

Abstract

Learn how Agentless Containers in Illumio Core let you monitor Kubernetes traffic and workloads across hybrid, multi-cloud environments without running agents in nodes.

Illumio Core Agentless Containers is a solution that monitors your containerized Kubernetes workloads without requiring agents on each node. It’s designed to provide visibility across large, complex, and diverse cloud and hybrid environments, giving Kubernetes administrators full insights into container traffic and workloads.

The intended audience for this topic includes Kubernetes administrators, security professionals, devops engineers, and application developers looking to:

  • Extend security across the container lifecycle, including reporting, and auditing

For best results, Illumio recommends viewing videos in Chrome.

Supported platforms

Agentless Containers provides visibility into Kubernetes workloads running on the following:

Cloud

  • Amazon EKS

  • Azure AKS

  • Google GKE

  • Oracle Cloud OKE

On-Premise

  • Self-managed Kubernetes

  • OpenShift

Supported Container Network Interface (CNI) Plugins

Agentless Containers is a solution that requires a Container Network Interface (CNI) plugin. It uses the CNI plugin to ingest pod-level network flows, get traffic flow data, and provide visibility into Kubernetes traffic. Agentless Containers currently supports the following configurations:

CNI Plugins

Platform(s)

Prerequisites and Configuration

Visibility

Cilium + Hubble Relay (recommended)

  • Standalone vanilla Kubernetes

  • Amazon EKS (via Cilium chaining mode)

  • Azure AKS (via Cilium chaining mode)

How to configure

  • Enable Hubble Relay for native flow ingestion and identity-aware traffic analysis.

  • Enabling Hubble allows Agentless Containers to natively ingest network flows for deep visibility and identity-aware traffic analysis. See Cilium Open Source Installation

Yes

AWS VPC CNI

Amazon EKS Auto Mode

Prerequisites

  • VPC CNI Add-on version 1.14 or later

How to configure

  • The Amazon VPC CNI Network Policy Agent must be enabled

  • Network policy event (flow) logging must be enabled and configured to output logs to stdout

  • Configuration must be applied using the aws eks update-addon command

    aws eks update-addon \
  --cluster-name <your-cluster-name> \
  --addon-name vpc-cni \
  --resolve-conflicts OVERWRITE \
  --configuration-values '{
    "enableNetworkPolicy": "true",
    "nodeAgent": {
      "enablePolicyEventLogs": "true",
      "networkPolicyAgentLogFileLocation": "stdout",
      "logLevel": "debug"
    }
  }'

See Configure Amazon EKS Auto Mode Clusters for AWS VPC CNI Network Policy Flow Logs.

Yes

OVN-Kubernetes (OVN-K) CNI

OpenShift

Prerequisites

  • An installation of OpenShift CLI (oc)

How to configure

  • See Configure OpenShift OVN-Kubernetes

  • When OVN-Kubernetes is used as the CNI plugin, the Illumio Core operator becomes an IPFIX collector, allowing you to export from your OVN cluster to the Author's Name service.

Yes

OKE with Cilium

Oracle Container Engine for Kubernetes (OKE)

Prerequisites

  • Oracle Container Engine for Kubernetes (OKE) with Cilium in chaining mode.

How to configure

Yes

GKE Dataplane V2

Google GKE (Standard + Autopilot)

Prerequisites

  • GKE Standard: Dataplane V2 must be enabled on the cluster using the GKE cluster configuration option --enable-dataplane-v2 during cluster creation or update.

  • GKE Autopilot: Dataplane V2 is enabled by default and cannot be disabled.

How to configure

Yes

AKS Native CNI

Azure AKS

How to configure

Yes

Agentless Containers benefits

This solution allows rapid onboarding of Kubernetes clusters to Illumio Core, and reduces time and complexity. You can:

  • Simplify onboarding by eliminating the need for agents on nodes

  • Integrate Illumio Core with your existing cloud-native tools and infrastructure on large, distributed, multi-cloud environments

  • Eliminate the dependency on iptables and other Kubernetes node-level subsystems

Onboarding and managing your Kubernetes clusters

For directions on using Illumio Core to onboard and offboard your Kubernetes clusters, see Onboard and Offboard Kubernetes Clusters .

Viewing and managing your Kubernetes inventory

Illumio Core lets you identify and protect clusters in your environment. You can filter for Kubernetes resources by resources, regions, and other parameters.

See Kubernetes Resources Inventory .

Using the Kubernetes Map View

See Navigating the Kubernetes Map View.

Viewing your Kubernetes traffic visibility

See Search Traffic.

Agentless Containers limitations

  • Network policies are not supported at the time of writing

  • Cluster and node-level policy enforcement is not available for on-premise environments

  • Instance linking isn’t supported for GKE Autopilot clusters in Illumio because Google fully manages the worker nodes and doesn’t expose the underlying VM instances. Since those instances aren’t visible, Illumio can’t establish the required cloud‑to‑Kubernetes instance mapping.

Kubernetes permissions required by the cloud-operator container

The following Kubernetes permissions are required by the cloud-operator, and are specified in the Helm Chart.