Skip to main content

Illumio Core 22.5 Install, Configure, Upgrade

Prepare Your Environment

You need to do these steps before creating clusters or pairing profiles in the PCE, or subsequent deployment.

Caution

If the prerequisite steps are not done before deployment, then containerized environments and Kubelink can get disrupted.

Unique Machine ID

Some of the functionality and services provided by the Illumio C-VEN and Kubelink depend on the Linux machine-id of each Kubernetes cluster node. Each machine-id must be unique in order to take advantage of the functionality. By default, the Linux operating system generates a random machine-id to give each Linux host uniqueness. However, there are cases when machine-id's can be duplicated across machines. This is common across deployments that clone machines from a golden image, for example, spinning up virtual machines from VMware templates, creating compute instances from a reference image, or from a template from a Public Cloud source.

Important

Illumio Core requires a unique machine-id on all nodes. This issue is more likely to occur with on-premises or IaaS deployments, rather than with Managed Kubernetes Services (from Cloud Service Providers). For more information on how to create a new unique machine-id, see Troubleshooting.

Create Labels

For details on creating labels, see "Labels and Label Groups" in Security Policy Guide. The labels shown below are used in examples throughout this document. You are not required to use the same labels

Name

Label Type

Kubernetes Cluster

Application

OpenShift Cluster

Application

Production

Environment

Development

Environment

Data Center

Location

Cloud

Location

Kubelink

Role

Node

Role

Master

Role

Worker

Role

Configure Calico in Append Mode

In case your cluster is configured with Calico as the network plugin (usually for Kubernetes and not for OpenShift), both Calico and Illumio Core will write iptables rules on the cluster nodes.

  • Calico - Needs to write iptables rules to instruct the host how to forward packets (overlay, IPIP, NAT, and so on).

  • Illumio Core - Needs to write iptables rules to secure communications between nodes and/or Pods.

You should establish a hierarchy to make the firewall coexistence work smoothly because Illumio Core and Calico will write rules at the same time. By default, both solutions are configured to insert rules first in the iptables chains/tables and Illumio Core will remove other rules added by a third-party software (in the Exclusive mode).

To allow Calico to write rules along with Illumio without flushing rules from one another, you should:

  • Configure Illumio to work in Firewall Coexistence mode (default for workloads that are part of a container cluster).

  • Configure Calico to work in Append mode (default is Insert mode).

To configure Calico to work in Append mode with iptables:

  1. Edit the Calico DaemonSet:

    kubectl -n kube-system edit ds calico-node

  2. Locate the spec: > template: > spec: > containers: section inside the YAML file and change ChainInsertMode by adding the following code block:

    - name: FELIX_CHAININSERTMODE
  value: Append

  3. Save your changes and exit.

  4. Kubernetes will restart all Calico Pods in a rolling update.

For more information on changing Calico ChainInsertMode, see Calico documentation.