We’ve recently published an open source Kubernetes operator, the intents operator, that makes it easy to manage network policies and Kafka ACLs in a way that enables teams to control access without cross-team coordination, and keeps gradual rollout in mind, eliminating many points of friction with using network policies and Kafka ACLs.

The intents operator implements a concept called IBAC, or Intents-Based Access Control, for Kubernetes network policies and Kafka ACLs. For network policies, it means that developers that want to connect to another service, declare the intent to do so, and the operator creates appropriate network policies, as well as labeling pods and namespaces as needed.

For example:

  apiVersion: k8s.otterize.com/v1alpha1
  kind: ClientIntents
  metadata:
    name: intents-sample
  spec:
    service:
      name: my-client
    calls:
      - name: web-server

We’re building more of this stuff, and think it should be equally easy to get access even when you need to access different kinds of services on different platforms. Securely accessing services shouldn’t be hard - it should be easy to do the right thing and hard to shoot yourself in the foot, and it should work with your existing infrastructure and development workflows.

If you too have felt the pain of managing network policies, have a look and let us know what you think!