Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 📝 WalkthroughWalkthroughUpdates aws-privatelink.adoc to replace broker-count-based port listings with fixed port ranges for PrivateLink security group rules. Retains single-port rules for bootstrap and services (Kafka seed 30292, Schema Registry 30081, Panda Proxy 30282, Console 443). Sets Kafka API broker ports to 32000–32500 and HTTP Proxy broker ports to 35000–35500. Adds a note clarifying per-broker port pools and that rules work for any broker count, and adds a cross-reference to private service connectivity network ports documentation. Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Assessment against linked issues
Out-of-scope changes(No out-of-scope functional code changes detected.) Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
✅ Deploy Preview for rp-cloud ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
modules/networking/pages/aws-privatelink.adoc (3)
275-289: Tighten security group sources; avoid 0.0.0.0/0 in examples.Use client VPC CIDR or, preferably, the client instances’ security group as the source to prevent overly broad access.
Example (security group source):
- --group-id $SECURITY_GROUP_ID --protocol tcp --port 30292 --cidr 0.0.0.0/0 + --group-id $SECURITY_GROUP_ID --protocol tcp --port 30292 --source-group $APP_SGAnd for ranges (combine with the previous comment’s fix):
- --group-id $SECURITY_GROUP_ID \ - --ip-permissions 'IpProtocol=tcp,FromPort=32000,ToPort=32500,IpRanges=[{CidrIp=0.0.0.0/0}]' + --group-id $SECURITY_GROUP_ID \ + --ip-permissions 'IpProtocol=tcp,FromPort=32000,ToPort=32500,UserIdGroupPairs=[{GroupId='$APP_SG'}]'You can define
APP_SGearlier to point to the SG attached to your client instances or load balancers.Also applies to: 293-299
287-290: Clarify when port 443 is required.Briefly specify scenarios (for example, Console over PrivateLink, Data Plane API, Prometheus scraping) to avoid users opening 443 unnecessarily.
283-286: Name consistency: consider “HTTP Proxy (Panda Proxy)” once for discoverability.Some users still search for “Panda Proxy.” Adding the alias in one place helps them map the service.
Also applies to: 296-298
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
modules/networking/pages/aws-privatelink.adoc(1 hunks)
🔇 Additional comments (1)
modules/networking/pages/aws-privatelink.adoc (1)
271-271: Good clarification on per-broker port pools.Clear, actionable note that prevents common misconfigurations. Please verify the xref anchor resolves in the built docs.
Co-authored-by: Paulo Borges <paulohtb6@gmail.com>
✅ Actions performedReview triggered.
|
c4milo
left a comment
c4milo
left a comment
There was a problem hiding this comment.
LGTM, assuming the AWS CLI commands work. I didn't test them myself.
micheleRP
deleted the
DOC-1651-AWS-VPC-endpoints-security-group-ports-are-out-of-date
branch
4 participants
Description
This PR updates the AWS PrivateLink networking doc for adding security group rules.
32000-32500for Kafka API and35000-35500for HTTP Proxy) instead of specifying ports based on broker count, improving reliability for all cluster sizes.aws ec2 authorize-security-group-ingresscommands to match the new guidance, including more descriptive comments and grouping for bootstrap, Schema Registry, HTTP Proxy, and per-broker port pools.Resolves https://redpandadata.atlassian.net/browse/DOC-1651
Review deadline:
Page previews
Add security group rules
Checks