feat: allow cross-namespace communication to namespaces #309
Conversation
WalkthroughA new constant for an annotation key was added, and the Kubernetes network policy builder logic was updated to introduce a new NetworkPolicy. This policy allows cross-namespace network traffic between namespaces sharing the same owner, based on a label. No existing logic or interfaces were changed. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant netPol.Create()
participant Kubernetes API
User->>netPol.Create(): Request NetworkPolicies for deployment
netPol.Create()->>netPol.Create(): Extract owner ID from LeaseID
netPol.Create()->>netPol.Create(): Build allowSameOwner NetworkPolicy
netPol.Create()->>Kubernetes API: Append allowSameOwner policy to policies list
Kubernetes API-->>User: NetworkPolicies including allowSameOwner
Estimated code review effort2 (~15 minutes) Poem
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.2.2)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/product/migration-guide for migration instructions ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
cluster/kube/builder/netpol.go (1)
144-186: Consider the security implications of broad cross-namespace access.The new NetworkPolicy correctly implements cross-namespace communication for same-owner deployments. However, consider these security implications:
Broad access scope: The empty
PodSelectorallows ALL pods in a namespace to communicate with ALL pods in other same-owner namespaces, which may be broader than necessary for modular applications.Potential for unintended communication: Different deployments from the same owner could inadvertently communicate, which might not align with the principle of least privilege.
Suggestions for enhanced security:
- Consider adding deployment-specific labels to limit communication to related deployments only
- Document the security model clearly for operators to understand the implications
- Consider implementing this as an opt-in feature per deployment
The current implementation is functionally correct and serves the stated objective of enabling modular applications across namespaces.
Would you like me to suggest a more granular approach that limits cross-namespace communication to specific deployment groups?
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
cluster/kube/builder/builder.go(1 hunks)cluster/kube/builder/netpol.go(2 hunks)
🔇 Additional comments (2)
cluster/kube/builder/builder.go (1)
32-32: LGTM: Well-named constant following established conventions.The new constant follows the existing naming patterns and is appropriately placed among related constants. The value "akash-same-owner" clearly indicates its purpose for the new NetworkPolicy.
cluster/kube/builder/netpol.go (1)
40-41: LGTM: Clean owner ID extraction.The owner ID extraction from the deployment's LeaseID is straightforward and correct.
1 participant
Description
Currently, all namespaces on a provider are isolated from each other, regardless of whether they belong to the same tenant (lease.id.owner). This makes it impossible for tenants to deploy modular applications that span multiple namespaces within the same cluster.
This PR introduces a new NetworkPolicy called allow-same-owner, which allows ingress and egress traffic between namespaces that share the same lease.id.owner label. This enables intra-tenant communication while maintaining isolation from other tenants.
My Solution
Modify provider/cluster/kube/builder/netpol.go:
Benefits:
Future Updates
@ Author: Jesse Rohner