Harvest dynamic IP-to-tag mappings from public EKS, GKE, and AKS clusters in Strata Cloud Manager to enforce tag-based security policy.
Strata Cloud Manager (SCM) Cloud IP-Tag Harvesting collects dynamic IP-to-tag
mappings from Kubernetes workloads and distributes them to your AI Runtime
Security firewalls. Because Kubernetes and AI workloads are highly
ephemeral, AIRS firewall uses these harvested tags (namespaces, services, and pod
labels) to enforce granular, real-time security policies across dynamic container
environments without manual IP tracking. Nothing is installed in your clusters, and
access is read-only.
Cloud IP-Tag Harvesting supports Public Kubernetes Clusters across Amazon
EKS, Google Cloud GKE, and Microsoft Azure AKS. The cluster must have a
public API server endpoint. The system connects through the public
endpoint, such as service, endpoint, and node IPs, so firewalls that see this
traffic can enforce policy on it.
Allows AI Runtime Security firewall to resolve dynamic Kubernetes endpoints
continuously, ensuring policies that reference tags such as
k8s.exsvc_<service-name> (the external IP of a LoadBalancer
service) or k8s.app.<value> (a pod label) remain accurate as
workloads scale and change.
For more information, see the following:
