In some environments traffic segregation is needed due to security reasons, it would be good if zookeeper charm let us to decide where to bind zookeeper.
As I noted on https://bugs.launchpad.net/charms/+source/apache-kafka/+bug/1602666, we're going to add this functionality to the Apache Bigtop charm for Zookeeper. I believe the current plan is for the Bigtop charm to replace the current Zookeeper charm maintained by James for the Xenial series.
The work for that is not yet in review, but it should be very similar to the work on the Kafka charm, so we are targeting to have it done next week and the new charm promulgated for Xenial.
We'll kick the tires on this one and promulgate if all looks good.
Well, we kicked the tires and the car fell apart. The current impl allows you to bind zookeeper to a single ip address via a config option. However, config is applied to all zookeeper units. This is problematic because different units will have different IPs.
We're re-working this config option to support a network or interface name. This would allow you to configure zookeeper so it only binds to an IP in the given network or to the IP of the given interface name.
We'll update this bug with a new rev is ready to test.
There are 2 Zookeeper charms in play here. "zookeeper" provides the Bigtop zookeeper package, but will not work in a network restricted environment. "apache-zookeeper" provides the vanilla upstream zookeeper package, and does have a mechanism for installing in a net-restricted env.
Only "zookeeper" contains this interface binding functionality. I'll leave this bug opened to track the progress of bringing this feature into the "apache-zookeeper" charm.
I have backported the binding changes to apache-zookeeper, and made fixes similar to those in kafka (interface now shares correct ip; local ipv6 addresses no longer cause Exceptions on physical machines).