Document network flows

[jemag]

Use-Case

Current documentation does not clearly outline the necessary network flows needed for KEDA to work. This makes it significantly harder to write appropriate restrictive network policies for KEDA.

Although there is

• https://keda.sh/docs/2.15/operate/cluster/#firewall
• https://keda.sh/docs/2.15/operate/istio-integration/#example-configuration

They are not sufficient nor precise enough.

I would expect rather something like:

• https://cert-manager.io/docs/installation/best-practice/#network-requirements or
• https://external-secrets.io/latest/guides/security-best-practices/#network-traffic-and-security

Specification

• Describe each flow required to allow KEDA to work in the context of network policies.

Example:
keda-operator:
oubound

• Allow communication to API server on port 443
  Etc.

inbound

• Allow communication from monitoring agent on port 8080
• Allow communication from keda-operator-metrics on port 9666
  Etc.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

[jemag]

/not-stale

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

[jemag]

/not-stale

[zroubalik]

That would be great, are you willing to contribute this?

[jemag]

I am not opposed to it, the issue is that I am not confident in all the necessary KEDA network flows (hence my creation of this issue).
We did our best to be restrictive when we set up our network policies for KEDA, but I wouldn't want to document something that isn't 100% correct.