neo4j-helm icon indicating copy to clipboard operation
neo4j-helm copied to clipboard

We should not allow an option to expose cluster-internal services using a load balancer

Open eastlondoner opened this issue 4 years ago • 0 comments

  1. the discovery-lb.yaml file is badly named. It should be 'service' not 'lb' and probably 'internal' rather than 'discovery'. I suspect that I am partly to blame for this - if so, sorry.
  2. it is specifically for cluster-internal services (raft, discovery etc.) so why would you want to expose it to the outside work by using a load balancer ? This could be quite bad from a security perspective because by default cluster-internal protocols are not authenticated.
  3. raft can be a bottleneck for cluster performance so adding an extra network hop to a load balancer is not at all desirable.

I think the only option for the service defined in discovery-lb.yaml should be a headless ClusterIP type by default. Unless there is a use case that I am not thinking of.

n.b. The only possible reason that I can think of for trying this is if you are spreading a single Neo4j cluster over multiple K8s clusters and I do not believe that is in the scope of the helm chart - nor do I think it is necessary for that use case.

eastlondoner avatar Jan 30 '21 23:01 eastlondoner