Basics of Container Security Using Prisma AIRS Runtime Security
CNI chaining concepts and how Prisma AIRS secures your
east-west traffic using Container Network Interface (CNI) chaining.
| Where Can I Use This? | What Do I Need? |
|---|
- Securing Kubernetes Clusters
|
|
This page introduces you to the CNI chaining functionality in Prisma AIRS and explains how it uses this method to secure
east-west traffic inside Kubernetes clusters. Kubernetes hides network complexities from
external security tools, enabling attackers to conceal malicious traffic within pod
communications and exploit vulnerabilities in the container runtime. With CNI chaining,
you can integrate Prisma AIRS as an additional security
inspection layer alongside your existing primary CNI plugin outside your Kubernetes
cluster, without replacing your current network configuration.
Key Concepts
Before you begin, it is important to understand the following key concepts in a
containerized environment:
CNI Chaining: How Prisma AIRS Protects Containers
To effectively inspect containerized applications, Prisma AIRS
AI Runtime: Network intercept uses CNI chaining to create secure tunnels between
your applications and Prisma AIRS AI Runtime: Network
intercept. The CNI chaining redirects container traffic out of your Kubernetes
cluster to Prisma AIRS AI Runtime: Network intercept, which
is deployed outside the cluster. This provides complete visibility and control that
internal-only solutions can’t achieve and enables comprehensive east-west traffic
analysis that traditional security approaches often miss.
The architecture diagram in figure 1 illustrates how Prisma AIRS achieves application-specific visibility and control of container traffic in all
directions, including both inbound and outbound, as well as east-west traffic within
the Kubernetes cluster. Prisma AIRS AI Runtime: Network
intercept delivers comprehensive security through native Kubernetes integration by
acting as an additional CNI plugin alongside your existing primary CNI plugin, such
as Calico or Flannel. This CNI chaining is used to bypass network address
translation (NAT) limitations, providing direct access to the Kubernetes network for
enhanced visibility. When containers communicate, traffic flows through both plugins
before reaching its destination:
- First, through your primary CNI for basic networking functions, like IP
assignment and routing.
- Then, through Prisma AIRS AI Runtime: Network
security for deep inspection.
CNI chaining establishes tunnels to redirect traffic from your pod applications to
Prisma AIRS AI Runtime: Network intercept, enabling
thorough traffic inspection.
Management Options
Choose the management approach that best suits your environment:Container Security Requirements
You need the following to deploy container security with Prisma AIRS:
- Panorama Plugin for
Kubernetes.
- YAML files that include the required fields and object
specifications for deploying the resources in your Kubernetes clusters, published on GitHub.
- Multus CNI.
Additional Resources
Additional resources on container security with Prisma AIRS AI Runtime Security network intercept:
