miki3421 opened a new pull request, #145: URL: https://github.com/apache/openserverless-operator/pull/145
Tenant action pods in a full 0.9.0 installation can reach shared, unauthenticated Kafka and ZooKeeper endpoints. This change restricts their ingress to the required control-plane and monitoring pods while retaining existing component versions, protocols and PVC contents. Closes apache/openserverless#276. ### Changes - Add same-namespace NetworkPolicies with explicit client/port allowlists. Every allowed selector excludes pods carrying `user-action-pod`, regardless of its value. - Apply policies before workloads and wait for StatefulSet rollout. A template revision rolls legacy messaging pods once to close existing connections. - Automatically reconcile enabled ZooKeeper then Kafka during operator resume and Whisk updates; propagate errors and leave disabled/slim components untouched. - Add 19 focused lifecycle/policy regression tests and `MESSAGING_SECURITY.md`. ### Validation - Re-ran the complete operator unittest suite before publication: **66/66 passed**. - Existing synthetic K3s lab validation: **16/16** tenant connections reachable before the patch and denied after automatic operator resume. - Trusted clients, metrics, action-labelled spoofing and cross-namespace checks: **8/8 passed**. - Alpha/Beta: **15/15**; Redis Lua: **84/84**; Streamer: **24/24**; scheduled actions and both frontends remained functional. - Repeating operator resume preserved Kafka/ZooKeeper pod identities. Application source and deployed action definitions remained unchanged. The lab used an unpublished local image and exercised image replacement/restart plus the actual Kopf resume handler. The exact `ops update operator` CLI command and a new full installation were not repeated in this follow-up. The first rollout temporarily interrupted messaging while consumers/invoker health recovered. ### Deployment requirements and review notes NetworkPolicy enforcement is required. Standard Kind networking without an enforcing policy provider does not establish this boundary. Administrator-added broad allow policies and compromised trusted control-plane pods remain outside the ordinary-tenant protection. The targeted Daybreak diff review confirmed the automatic-upgrade correction and identified one remaining Medium teardown limitation: normal owner-backed Whisk deletion can bypass the explicit policy-last helper when saved process state is absent. Owner garbage collection does not guarantee policy deletion order. The contributor accepted this as non-blocking; this PR documents the limitation and does not fix it. No release workflow, image pin, component upgrade, or application-code change is included. This branch is hosted on the contributor's personal fork. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
