Disable NetworkPolicy generation

[armisz]

Hi,

Is there a way to disable the automatic NetworkPolicy generation for ZK and Kafka nodes?

By default, the generated NetworkPolicies grant general access to ZK and Kafka "technical" ports like 2181, 9091, 9404, 9999 to all other pods. I would like to limit this. Furthermore, I cannot specify networkPolicyPeers for the listener port 9093 upfront at the time when I deploy Kafka because in my setup client components contribute their own NetworkPolicies.

Thanks
Michael

[scholzj]

No, there is currently no way how to disable them.

By default, the generated NetworkPolicies grant general access to ZK and Kafka "technical" ports like 2181, 9091, 9404, 9999 to all other pods. I would like to limit this. Furthermore, I cannot specify networkPolicyPeers for the listener port 9093 upfront at the time when I deploy Kafka because in my setup client components contribute their own NetworkPolicies.

I do not think this is completely true - ports 2181 in Zoo and 9091 are for sure not accessible from all other pods but limited to the Strimzi pods.

[scholzj]

TBH, that is not how the network policy looks in my case ...

Zookeeper:

ingress:
    - from:
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-zookeeper
      ports:
      - port: 2888
        protocol: TCP
      - port: 3888
        protocol: TCP
    - from:
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-kafka
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-zookeeper
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-entity-operator
      - podSelector:
          matchLabels:
            strimzi.io/kind: cluster-operator
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-cruise-control
      ports:
      - port: 2181
        protocol: TCP
    - ports:
      - port: 9404
        protocol: TCP

I.e. ...

• Ports 2888 and 3888 are used only internally by Zookeeper so only Zookeeper pods have access
• Port 2181 is used by other Strimzi components as well - operators, Kafka etc.
• Port 9404 (metrics) is open for everyone

Kafka:

    ingress:
    - from:
      - podSelector:
          matchLabels:
            strimzi.io/kind: cluster-operator
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-kafka
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-entity-operator
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-kafka-exporter
      - podSelector:
          matchLabels:
            strimzi.io/name: my-cluster-cruise-control
      ports:
      - port: 9091
        protocol: TCP
    - ports:
      - port: 9092
        protocol: TCP
    - ports:
      - port: 9093
        protocol: TCP
    - ports:
      - port: 9094
        protocol: TCP
    - ports:
      - port: 9404
        protocol: TCP

I.e. ...

• Port 9091 is accessible only by Strimzi components, operators, Kafka Exporter, Cruise Control etc.
• Ports 9092, 9093, 9094 are user listeners without any configured peers and are accessible to everyone by default
• 9404 (metrics) is accessible to everyone

Which ports are accessed by the Cluster Operator?

9091 on Kafka and 2181 on Zookeeper

[armisz]

I have double-checked the NetworkPolicies on a fresh installation which have been created using Strimzi 0.20.0. They are the same ones which I have initially added to this discussion. What could be a reason for the difference to yours?

[scholzj]

TBH, I tried it on latest main branch build as I do not have 0.20 running anywhere. I'm not aware of any bugs in this area since 0.20 - but it is possible that I just run out of memory. Other option is that you have some tooling modifying the network policies in your cluster (either some special controllers, or some admission webhooks etc.).

[armisz]

According to the cluster admins there is no such tooling set up.

In the meantime I have realized that the generated NPs look exactly the same as yours if I deploy on an OpenShift 4 cluster (v4.6.19). On OpenShift v3.11.394 I end up having those stripped NPs. What the hack?

[scholzj]

Ahh, right ... well, OpenShift 3.11 does not support the full network policies specification as modern Kubernetes / OpenShift versions do. So they are generated differently because of that otherwise it would not work.