-
Feature Request
-
Resolution: Done
-
Normal
-
None
-
None
-
False
-
None
-
False
-
Not Selected
-
-
-
-
1. Proposed title of this feature request
Add firewall plugin in coredns image
2. What is the nature and description of the request?
To build a multi tenant cluster and separate the customers on it as much as possible.
Right now customers can resolve services from namespaces of other customers.
We want to prevent Pods in certain Namespaces from looking up Services in other Namespaces.
For example we have multiple namespaces like:
```
apiVersion: v1
kind: Namespace
metadata:
labels:
customer: customer1
kubernetes.io/metadata.name: customer1-ns
name: customer1-ns1
```
```
apiVersion: v1
kind: Namespace
metadata:
labels:
customer: customer2
kubernetes.io/metadata.name: customer2-ns
name: customer2-ns-5
```
Based on the customer label we want to prevent customer1 from resolving services of customer2. I'm hoping it could be achieved with the firewall plugin. But unfortunately this firewall plugin is not in the coredns image by default:
```
coredns -plugins | grep firewall
<no return>
```
Also the DNS operator should support some configuration for the firewall plugin.
See also:
https://github.com/coredns/policy#kubernetes-metadata-multi-tenancy-policy
3. Why does the customer need this? (List the business requirements here)
- To keep isolation between customers from accessing each other resources.
4. List any affected packages or components.