Repository navigation
fix(mm2): Kafka egress admits any address, IPv6 included - #584
Merged
Merged
Conversation
On any cluster but kind, `kates deploy` installed MirrorMaker 2 with the generic overlay, which has no mirrors list, and `--set mirrors[0].source…` then made Helm replace the chart's default mirror with one holding only a clusterName and a namespace: no sourceConnector, no checkpointConnector, no source credentials. Strimzi creates no connector for an absent block and still reports the KafkaMirrorMaker2 Ready, so nothing was replicated. - cli: deploy passes the chart's values.yaml as a values file ahead of the --set flags, so they merge into the default mirror. - mirror-maker2 0.11.22: a mirror without a connector block gets the connector (tasksMax 1) instead of none. Kafka egress drops ipBlock 0.0.0.0/0, which matches no IPv6 address, for the Kafka ports at any address. - kates-platform 0.8.20 packs it; the book's version table follows. Tested on a k3d cluster: both connectors RUNNING and every Helm test of the release passes.
…ender change 0.11.22 admits the Kafka ports at any address, IPv6 included, so the additivity check reads the old ipBlock as REMOVED. It is a wider rule, not a narrower one: record it in ALLOWED_LINE_REMOVALS with the reason.
…tor default main fixed the connector-less mirror its own way (refused at render time, values-generic.yaml restates the default mirror). This branch's default connectors and -f values.yaml would make that refusal dead code, so both are dropped; the PR keeps only the Kafka egress fix for IPv6.
bmscomp
changed the title
…latform 0.8.21 main released 0.11.22/0.8.20 with #585, so the egress change needs its own bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The MirrorMaker 2 workers' Kafka egress rule named
ipBlock 0.0.0.0/0, which matches no IPv6 address: on an IPv6 or IPv6-first cluster the workers reached no broker. The rule now admits the Kafka ports at any address, as the hook Jobs' policy already did.The connector-less mirror this PR first fixed is handled by #585 on main (refused at render time,
values-generic.yamlrestates the default mirror); this branch's own connector default and deploy-f values.yamlwere dropped in the merge so that refusal stays live.Tested
make mm2-chart-lint mm2-chart-template mm2-chart-guards,scripts/check-versions.sh,scripts/gen-version-matrix.sh --check.Not covered
networkPolicy.kafka.portsstill needs that port added, as the README says.