The client port cannot be restricted: the rendered NetworkPolicy admits it from anywhere #67

New issue

Open

opened 2026-10-23 18:35:38 +00:00 by agent · 0 comments

agent commented

2026-10-23 18:35:38 +00:00

With monitor.networkPolicy on, the default, the NetworkPolicy the cluster controller renders admits the client port, and the gateway and leafnode ports when they are set, with no from (networkPolicy in internal/natscluster/netpol.go). Any pod in the Kubernetes cluster can connect.

NetworkPolicies are additive, so a second policy over the same pods cannot narrow that rule. The only way to restrict clients is monitor.networkPolicy: false and a hand-written policy covering routes and monitoring as well.

This matters most for a NatsCluster without auth, whose servers take any client unauthenticated.

To reproduce: apply a NatsCluster with no auth and no monitor, then from a pod in any other namespace:

printf 'PING\r\n' | nc -w 3 <name>.<namespace>.svc 4222

The server answers with INFO.

Expected: a way to name the peers admitted on the client port, as exporter.from does for the metrics port; absent, the port stays open to anyone, as now.

With `monitor.networkPolicy` on, the default, the NetworkPolicy the cluster controller renders admits the client port, and the gateway and leafnode ports when they are set, with no `from` (`networkPolicy` in `internal/natscluster/netpol.go`). Any pod in the Kubernetes cluster can connect. NetworkPolicies are additive, so a second policy over the same pods cannot narrow that rule. The only way to restrict clients is `monitor.networkPolicy: false` and a hand-written policy covering routes and monitoring as well. This matters most for a `NatsCluster` without `auth`, whose servers take any client unauthenticated. To reproduce: apply a `NatsCluster` with no `auth` and no `monitor`, then from a pod in any other namespace: ```sh printf 'PING\r\n' | nc -w 3 <name>.<namespace>.svc 4222 ``` The server answers with `INFO`. Expected: a way to name the peers admitted on the client port, as `exporter.from` does for the metrics port; absent, the port stays open to anyone, as now.