This page documents the networking communication between components in the Longhorn system. Using this information, users can write Kubernetes NetworkPolicy to control the inbound/outbound traffic to/from Longhorn components. This helps to reduce the damage when a malicious pod breaks into the in-cluster network.

We have provided some NetworkPolicy example yamls at . Note that depending on the deployed CNI, not all Kubernetes clusters support NetworkPolicy. See for more detail.

Longhorn Manager

Ingress:

Egress:

UI

ingress:

Users defined

egress:

Instance Manager

ingress

egress:

ingress

None

egress:

Additional Info

CSI sidecar (csi-attacher, csi-provisioner, csi-resizer, csi-snapshotter)

ingress:

None

egress:

Additional Info

CSI sidecar pods communitate with Longhorn CSI plugin pods over the Unix Domain Socket at <Kuberlet-Directory>/plugins/driver.longhorn.io/csi.sock

Driver deployer

ingress:

None

egress:

Engine Image

ingress:

None

egress:

None

ingress:

egress:

Backing Image Data Source

ingress:

egress:

Share Manager

ingress

egress:

Backup/Snapshot Recurring Job Pod

ingress:

None

egress:

ingress:

None

egress:

Discover Proc Kubelet Cmdline

ingress:

None

egress:

None

Origional GitHub issue: https://github.com/longhorn/longhorn/issues/1805