Kubernetes에서 Workload Protection 설정

다음 지침을 따라 Workload Protection을 활성화하세요.

Fargate 컴퓨팅 옵션이 구성된 Amazon EKS에 Workload Protection을 배포하려면 Fargate 배포 페이지를 참조하세요.
Collecting events using Workload Protection will affect your billing. For more information, see Datadog Pricing.

전제 조건

참고: SBOM 수집은 Google Kubernetes Engine(GKE)의 이미지 스트리밍 기능과 호환되지 않습니다. 비활성화하려면 GKE 설명서의 이미지 스트리밍 비활성화 섹션을 참조하세요.

설치

    1. datadog-agent.yaml 파일의 spec 섹션에 다음을 추가합니다.

      # datadog-agent.yaml file
apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
spec:
  features:
    # (Optional) Integrate with Kubernetes to enrich Workload Protection events with Kubernetes user identities
    admissionController:
      enabled: true
      cwsInstrumentation:
        enabled: true

    remoteConfiguration:
      enabled: true
    # Enables Threat Detection
    cws:
      enabled: true
    # Enables Misconfigurations
    cspm:
      enabled: true
      hostBenchmarks:
        enabled: true
    # Enables the image metadata collection and Software Bill of Materials (SBOM) collection
    sbom:
      enabled: true
      # Enables Container Vulnerability Management
      # Image collection is enabled by default with Datadog Operator version `>= 1.3.0`
      containerImage:
        enabled: true

        # Uncomment the following line if you are using Google Kubernetes Engine (GKE) or Amazon Elastic Kubernetes (EKS)
        # uncompressedLayersSupport: true

      # Enables Host Vulnerability Management
      host:
        enabled: true

    2. 변경 사항을 적용하고 Agent를 재시작합니다.

    1. datadog-values.yaml 파일의 datadog 섹션에 다음을 추가합니다.

      # datadog-values.yaml file

# (Optional) Integrate with Kubernetes to enrich Workload Protection events with Kubernetes user identities
clusterAgent:
  admissionController:
    enabled: true
    cwsInstrumentation:
      enabled: true

datadog:
  remoteConfiguration:
    enabled: true
  securityAgent:
    # Enables Threat Detection
    runtime:
      enabled: true
    # Enables Misconfigurations
    compliance:
      enabled: true
      host_benchmarks:
        enabled: true
  sbom:
    containerImage:
      enabled: true

      # Uncomment the following line if you are using Google Kubernetes Engine (GKE) or Amazon Elastic Kubernetes (EKS)
      # uncompressedLayersSupport: true

    # Enables Host Vulnerability Management
    host:
      enabled: true

    # Enables Container Vulnerability Management
    # Image collection is enabled by default with Datadog Helm version `>= 3.46.0`
    # containerImageCollection:
    #   enabled: true

    2. Agent를 재시작합니다.

    RBAC 문제를 해결하려면 clusterRole.allowCreatePodsExec 옵션을 활성화한 상태로 clusterRole에 대해 차트를 실행하세요.

    helm install datadog-operator datadog/datadog-operator --set clusterRole.allowCreatePodsExec=true

    1. daemonset.yaml파일에서 security-agent 및 system-probe의 env 섹션에 다음 설정을 추가하세요. Workload Protection 이벤트를 Kubernetes 사용자 ID로 보강하려면 cluster-agent-deployment.yaml에서 선택 사항인 DD_ADMISSION_CONTROLLER_ENABLED 및 DD_RUNTIME_ADMISSION_CONTROLLER_CWS_INSTRUMENTATION_ENABLED 변수를 추가로 설정하세요.

        # Source: datadog/templates/daemonset.yaml
  apiVersion:app/1
  kind: DaemonSet
  [...]
  spec:
  [...]
  spec:
      [...]
        containers:
        [...]
          - name: agent
            [...]
            env:
              - name: DD_REMOTE_CONFIGURATION_ENABLED
                value: "true"
          - name: system-probe
            [...]
            env:
              - name: DD_RUNTIME_SECURITY_CONFIG_ENABLED
                value: "true"
              - name: DD_RUNTIME_SECURITY_CONFIG_REMOTE_CONFIGURATION_ENABLED
                value: "true"
              - name: DD_COMPLIANCE_CONFIG_ENABLED
                value: "true"
              - name: DD_COMPLIANCE_CONFIG_HOST_BENCHMARKS_ENABLED
                value: "true"
              - name: DD_SBOM_CONTAINER_IMAGE_USE_MOUNT
                value: "true"
          [...]

  # Source: datadog/templates/cluster-agent-deployment.yaml
  apiVersion:app/1
  kind: Deployment
  [...]
  spec:
    [...]
    template:
      [...]
      spec:
        [...]
        containers:
        [...]
          - name: cluster-agent
            [...]
            env:
              - name: DD_ADMISSION_CONTROLLER_ENABLED
                value: "true"
              - name: DD_RUNTIME_ADMISSION_CONTROLLER_CWS_INSTRUMENTATION_ENABLED
                value: "true"