Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support restricting intents by service port #485

Open
netthier opened this issue Sep 13, 2024 · 0 comments
Open

Support restricting intents by service port #485

netthier opened this issue Sep 13, 2024 · 0 comments

Comments

@netthier
Copy link

Is your feature request related to a problem? Please describe.

It's not uncommon for k8s services to expose multiple ports using the same service resource, e.g. metrics and api ports.
When generating NetworkPolicys using Otterize, one can only allow access to all ports at once, which breaks the principle of least privilege.

Describe the solution you'd like

The intents-operator should allow specifying the targeted port by name or number in ClientIntents or ProtectedServices.

Describe alternatives you've considered

Workarounds for this issue include splitting the service into services with one port each, which may not be convenient with 3rd party software, or manually deploying NetworkPolicys.

Additional context

This request was first made on Slack: https://otterizecommunity.slack.com/archives/C046SG6PRJM/p1726231851326429

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant