Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-4810

Add firewall plugin in coredns image

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Done
    • Icon: Normal Normal
    • None
    • None
    • Network Edge
    • False
    • None
    • False
    • Not Selected

      1. Proposed title of this feature request

      Add firewall plugin in coredns image

      2. What is the nature and description of the request?
      To build a multi tenant cluster and separate the customers on it as much as possible.
      Right now customers can resolve services from namespaces of other customers.
      We want to prevent Pods in certain Namespaces from looking up Services in other Namespaces.

      For example we have multiple namespaces like:
      ```
      apiVersion: v1
      kind: Namespace
      metadata:
      labels:
      customer: customer1
      kubernetes.io/metadata.name: customer1-ns
      name: customer1-ns1
      ```

      ```
      apiVersion: v1
      kind: Namespace
      metadata:
      labels:
      customer: customer2
      kubernetes.io/metadata.name: customer2-ns
      name: customer2-ns-5
      ```

      Based on the customer label we want to prevent customer1 from resolving services of customer2. I'm hoping it could be achieved with the firewall plugin. But unfortunately this firewall plugin is not in the coredns image by default:
      ```
      coredns -plugins | grep firewall
      <no return>
      ```

      Also the DNS operator should support some configuration for the firewall plugin.
      See also:
      https://github.com/coredns/policy#kubernetes-metadata-multi-tenancy-policy
      3. Why does the customer need this? (List the business requirements here)

      • To keep isolation between customers from accessing each other resources.

      4. List any affected packages or components.

              mcurry@redhat.com Marc Curry
              rhn-support-chdeshpa Chinmay Deshpande
              Marc Curry
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: