Limit JMX and metrics port access using the generated NetworkPolicy

[armisz]

Hi,
I am running Strimzi 0.45.0. For my Kafka cluster I declare a TLS listener, enable metrics and the JMX port.
For all those, the Cluster Operator generates a NetworkPolicy for the ports 9093, 9404 and 9999.
I can limit the access of the port 9093 using networkPolicyPeers, but there seems to be no such option for the ports 9404 and 9999.
How can I limit the access to these ports?

Thanks!
Michael

[scholzj]

The only option is currently to disable the Cluster Operator from managing the network policies (see https://strimzi.io/docs/operators/latest/full/deploying.html#ref-operator-cluster-str, look for STRIMZI_NETWORK_POLICY_GENERATION). That would allow you to set any network policy you want. But it i not possible in any other way.

Keep in mind that:

• You normally use either JMX or Prometheus metrics, so you should normally not use both 9404 and 9999
• The Prometheus metrics are just metrics, nothing else. The JMX is probably a bit more dangerous - but in general you should not need it for anything.