This page documents the networking communication between components in the Longhorn system. Using this information, users can write Kubernetes NetworkPolicy to control the inbound/outbound traffic to/from Longhorn components. This helps to reduce the damage when a malicious pod breaks into the in-cluster network.

We have provided some NetworkPolicy example yamls at here. Note that depending on the deployed , not all Kubernetes clusters support NetworkPolicy. See here for more detail.

Longhorn Manager

Ingress:

Egress:

UI

ingress:

Users defined

egress:

Instance Manager

ingress

egress:

Longhorn CSI plugin

ingress

None

egress:

Additional Info

ingress:

None

egress:

Additional Info

CSI sidecar pods communitate with Longhorn CSI plugin pods over the Unix Domain Socket at <Kuberlet-Directory>/plugins/driver.longhorn.io/csi.sock

Driver deployer

ingress:

None

egress:

Conversion and Admission Webhook Server

ingress:

NFS Recovery Backend Server

ingress:

Engine Image

ingress:

None

egress:

None

ingress:

egress:

Backing Image Data Source

ingress:

egress:

Share Manager

ingress

egress:

Backup/Snapshot Recurring Job Pod

ingress:

None

egress:

Uninstaller

ingress:

None

egress:

ingress:

None

egress:

None

Original GitHub issue: https://github.com/longhorn/longhorn/issues/1805