Longhorn Networking

Overview

This page documents the networking communication between components in the Longhorn system. Using this information, users can write Kubernetes NetworkPolicy to control the inbound/outbound traffic to/from Longhorn components. This helps to reduce the damage when a malicious pod breaks into the in-cluster network.

We have provided some NetworkPolicy example yamls at here. Note that depending on the deployed CNI, not all Kubernetes clusters support NetworkPolicy. See here for more detail.

Note: If you are writing network policies, please revisit this page before upgrading Longhorn to make the necessary adjustments to your network policies.

Longhorn Manager

Ingress:

Egress:

UI

ingress:

Users defined

egress:

Instance Manager

ingress

egress:

Longhorn CSI plugin

ingress

None

egress:

Additional Info

Longhorn CSI plugin pods communitate with CSI sidecar pods over the Unix Domain Socket at <Kuberlet-Directory>/plugins/driver.longhorn.io/csi.sock

CSI sidecar (csi-attacher, csi-provisioner, csi-resizer, csi-snapshotter)

ingress:

None

egress:

Additional Info

CSI sidecar pods communitate with Longhorn CSI plugin pods over the Unix Domain Socket at <Kuberlet-Directory>/plugins/driver.longhorn.io/csi.sock

Driver deployer

ingress:

None

egress:

Conversion and Admission Webhook Server

ingress:

Engine Image

ingress:

None

egress:

None

Backing Image Manager

ingress:

egress:

Backing Image Data Source

ingress:

egress:

Share Manager

ingress

egress:

None

Backup/Snapshot Recurring Job Pod

ingress:

None

egress:

Uninstaller

ingress:

None

egress:

Discover Proc Kubelet Cmdline

ingress:

None

egress:

None

Original GitHub issue: https://github.com/longhorn/longhorn/issues/1805