loadBalancerSourceRanges setting option

[sreejesh-radhakrishnan-db]

Hi we have a wast range of IP/CIDR where our KAFKA consumer runs.

Hence wanted to see is there a wild card entry for this variable possible

loadBalancerSourceRanges:

so that KAFKA accept connection from any IP and not the listed in " loadBalancerSourceRanges:" , we control the access using ACL + SSL.

[scholzj]

I'm not sure I follow the question. But in general, the loadBalancerSourceRanges is a list of Strings. Typically, these will be CIDR ranges used to configure some firewall (e.g. Security Groups on AWS). But how it is interpreted in detail depends on your platform and infrastructure. Strimzi just passes them into the Kubernetes Service object and the rest is up to Kubernetes.

[sreejesh-radhakrishnan-db]

Hi, what I have observed in GKE, we have to provide the IP range of any application which want to connect to the listener. If I dont add the IP I get connection TIMEOUT error

for example for internal POD to GKE , I have a add the ip cidr 240.0.0.0/22 , for another set of app on-prem I need to set 190.0.0.0/24 etc

this is a huge list in my case and wanted to know, if I can wildcard this loadBalancerSourceRanges variable :-) for ease of my use case

i.e any Source IP is allowed to connect to listener.

[scholzj]

Well, I think it takes a list of CIDR addresses only. But as I said, Strimzi just passes it to Kubernetes. I don't think we validate the CIDRs in any way. So the question is what does your cloud provider support. If it supports any other kinds of wildcards, it should be fine for you to use it.

Also, ideally, you should not use load balancer listeners for pods running in the same cluster. You should use an internal listener. That improves latency, saves costs, etc.

[sreejesh-radhakrishnan-db]

for POD we do use internal listener in 9092 due to above said reasons by you (mproves latency, saves costs, etc.). for testing to seef POD can connect to ILB without the IP in loadBalancerSourceRanges it was a forceful change than implemetation.

thanks for the reply, I will figure out what GKE gives us.