Deploy CrowdSec to Protect Your Services From Bad Actors & Common Attacks - Kubernetes

[@crowdsec]

Another great video on CrowdSec! 🦙

[@Jims-Garage]

Thanks! Keep up the great work guys.

[@giuseppebinetti87]

Hello Jim, I use Cilium CNI for my RKE2 and the Local TrafficPolicy works well. Also I really recommend Cilium as it has a built in LB feature (you can ditch metalLB then), has also network policy, eBPF and much more

[@Jims-Garage]

Thanks, I have a feeling that this is the way I'll go. It's a more enterprise solution.

[@-rm-rf]

Awesome - looking forward to trying this out!

[@Jims-Garage]

Hope you enjoy it!

[@markandrow4010]

I'm new here and your tutorials are great, thank you by the way. 👍

[@Jims-Garage]

Awesome, thank you!

[@DudeItsDallyBoy]

Love this thank you for making these. They really help. Any chance for the nextonenyou could do authentik in kubernetes?

[@Jims-Garage]

Thanks, I'll take a look at it.

[@michaelbouckley4455]

reflector causes: Error: UPGRADE FAILED: execution error at (traefik/templates/_podtemplate.tpl:441:16): ERROR: plugin enabled is missing moduleName/version keys !

[@geemobile6037]

Hey Jim. Firstly thank you doesn’t cover it for the work that you put into these guides. Will you be putting a pin here when you finish the rke2 and cilium script or should I keep an eye out on discord?

[@Jims-Garage]

I recommend using K3S for now (or try to figure it out and let me know 😂). I'll probably come back to it early in the new year, quite a few irons in the fire at the moment but I am working on it

[@xXV1ralXx]

Can you please revisit this? It appears that a the config for how you deploy plugin in traefik has changed

[@Jims-Garage]

You're correct. There are some differences now. I'll consider redoing it.

[@antoniomax3163]

Hi, I have several networks. They are all for nat and I don't have a dedicated address. If I buy the cheapest vds, what should I put there and how to set up switching and routing?My clients will be either microtic or keenetic. How would you act in such a situation?

[@LampJustin]

I'd setup a remote HAProxy and forward all traffic to your nodes over a Tunnel. Don't set the Traffic policy to local, but enable ProxyProtocol on traefik (or whatever you use) and HAProxy.

[@LampJustin]

I just checked the docs of RKE2. But there really, doesn't seem to be any mention or feature flag for the local traffic policy. I think you have to options to get it working: The first would be to use the ProxyProtocol, which would require you to run a LoadBalancer like HAProxy (instead of metalllb/kube-vip) in front of traefik. The second option would be to use Cilium and use it to replace kube-proxy. You might need to use DSR as well and/or k8s v1.28+ as they removed some iptables code from kubelet in that release. No idea why it was even in there...

[@Jims-Garage]

Good research, same information that I found. Think I'll do Calico and haproxy, see where it goes.

[@LampJustin]

@@Jims-Garage ProxyProtocol is definitely worth a video. I see a lot of customers struggling to understand or set it up. And in many cloud scenarios it is needed as the provided lb service can't save the source IP.

[@Jims-Garage]

@@LampJustin thanks, I'll look into this

[@aspectbuildingplastering7633]

Im pulling my hair out lol everything has gone super smooth deploying k3s, rancher, fleet etc. Your videos are superb! but Crowdsec is causing me bother :( When i try to upgrade Traefik with the updated values its borking and spitting out "Error: UPGRADE FAILED: execution error at (traefik/templates/_podtemplate.tpl:522:16): ERROR: plugin enabled is missing moduleName/version keys !" any ideas James?

[@aspectbuildingplastering7633]

Fixed :) Discord Guru's to the rescue

[@Jims-Garage]

Paste the fix here as well please :)