How to customize NetworkPolicy for Burrow to access ZK

[scottc-git]

I am trying to monitor consumer lags using Burrow, however, it could not connect to the zookeeper service IP. I found there is a NetworkPolicy created by Strimzi - which is nice.

$ k describe netpol strimzi-network-policy-zookeeper
Name:         strimzi-network-policy-zookeeper
Namespace:    tdp-mirror-az-qai
Created on:   2022-07-20 19:53:30 -0700 PDT
Labels:       app.kubernetes.io/instance=strimzi
              app.kubernetes.io/managed-by=strimzi-cluster-operator
              app.kubernetes.io/name=zookeeper
              app.kubernetes.io/part-of=strimzi-strimzi
              strimzi.io/cluster=strimzi
              strimzi.io/kind=Kafka
              strimzi.io/name=strimzi
Annotations:  <none>
Spec:
  PodSelector:     strimzi.io/name=strimzi-zookeeper
  Allowing ingress traffic:
    To Port: 2888/TCP
    To Port: 3888/TCP
    From:
      PodSelector: strimzi.io/name=strimzi-zookeeper
    ----------
    To Port: 2181/TCP        <============  Protected!
    From:
      PodSelector: strimzi.io/name=strimzi-kafka
    From:
      PodSelector: strimzi.io/name=strimzi-zookeeper
    From:
      PodSelector: strimzi.io/name=strimzi-entity-operator
    From:
      NamespaceSelector: <none>
      PodSelector: strimzi.io/kind=cluster-operator
    From:
      PodSelector: strimzi.io/name=strimzi-cruise-control
    ----------
    To Port: 9404/TCP
    From: <any> (traffic not restricted by source)
  Not affecting egress traffic
  Policy Types: Ingress

According to this NetworkPolicy, port 2181 is open only for those Strimzi pods that have specific labels.

Question: Is there a way to customize this such that we can add more 'allowed' labels/pods such as Burrow?

[scottc-git]

Looks like a related work is in proposed state. In the meantime, what can be a workaround?

[scholzj]

Strimzi does not expose ZooKeeper. Apart from the network policies, it is protected by TLS Client Authentication. You can use this unofficial project if you want to connect to ZooKeeper: https://github.com/scholzj/zoo-entrance (use at your own risk). Also keep in mind that ZooKeeper is being removed from Kafka.

PS: Strimzi has built-in support for Kafka Exporter for consumer lag monitoring.

[scottc-git]

I've used the ZooEntrance quite a long time ago. Thanks for the reminder, @scholzj. Yes, I am aware of ZK removal. Delegating this access control business to OpenPolicyAgent can be another (long-term) option and I am glad to see OPA is used in this project.