From 14979a567ebd90475496b7d35f3859a0ab3bddfb Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Sat, 7 Jul 2018 18:13:56 +0200 Subject: [PATCH] Add ports for local traffic --- .../requirements_ports_rancher.html | 4 +- .../shortcodes/requirements_ports_rke.html | 75 +++++++++++++++++-- 2 files changed, 71 insertions(+), 8 deletions(-) diff --git a/layouts/shortcodes/requirements_ports_rancher.html b/layouts/shortcodes/requirements_ports_rancher.html index eaf601ac3b1..4d4263990f6 100644 --- a/layouts/shortcodes/requirements_ports_rancher.html +++ b/layouts/shortcodes/requirements_ports_rancher.html @@ -1,6 +1,6 @@

Rancher nodes:
Nodes running the rancher/rancher container

-
Rancher nodes - Inbound rules
+

Rancher nodes - Inbound rules

@@ -21,7 +21,7 @@
ProtocolRancher agent, Rancher UI/API, kubectl
-
Rancher nodes - Outbound rules
+

Rancher nodes - Outbound rules

diff --git a/layouts/shortcodes/requirements_ports_rke.html b/layouts/shortcodes/requirements_ports_rke.html index 8bf136cb8e5..f5b0491a08a 100644 --- a/layouts/shortcodes/requirements_ports_rke.html +++ b/layouts/shortcodes/requirements_ports_rke.html @@ -1,6 +1,6 @@

etcd nodes:
Nodes with the role etcd

-
etcd nodes - Inbound rules
+

etcd nodes - Inbound rules

Protocol
@@ -26,6 +26,12 @@ + + + + + + @@ -33,7 +39,7 @@
Protocol
  • etcd nodes
  • controlplane nodes
  • worker nodes
 Canal/Flannel VXLAN overlay networking
TCP9099
  • etcd node itself (local traffic, not across nodes)
See Local node traffic		Canal/Flannel livenessProbe/readinessProbe
TCP 10250kubelet
-
etcd nodes - Outbound rules
+

etcd nodes - Outbound rules

@@ -71,9 +77,15 @@ + + + + + +
Protocol
  • etcd nodes
  • controlplane nodes
  • worker nodes
 Canal/Flannel VXLAN overlay networking
TCP9099
  • etcd node itself (local traffic, not across nodes)
See Local node traffic		Canal/Flannel livenessProbe/readinessProbe

controlplane nodes:
Nodes with the role controlplane

-
controlplane nodes - Inbound rules
+

controlplane nodes - Inbound rules

@@ -105,12 +117,24 @@ + + + + + + + + + + + + @@ -118,7 +142,7 @@
Protocol
  • etcd nodes
  • controlplane nodes
  • worker nodes
 Canal/Flannel VXLAN overlay networking
TCP9099
  • controlplane node itself (local traffic, not across nodes)
See Local node traffic		Canal/Flannel livenessProbe/readinessProbe
TCP 10250
  • controlplane nodes
 kubelet
TCP10254
  • controlplane node itself (local traffic, not across nodes)
See Local node traffic		Ingress controller livenessProbe/readinessProbe
TCP/UDP 30000-32767NodePort port range
-
controlplane nodes - Outbound rules
+

controlplane nodes - Outbound rules

@@ -150,15 +174,27 @@ + + + + + + + + + + + +
Protocol
  • etcd nodes
  • controlplane nodes
  • worker nodes
 Canal/Flannel VXLAN overlay networking
TCP9099
  • controlplane node itself (local traffic, not across nodes)
See Local node traffic		Canal/Flannel livenessProbe/readinessProbe
TCP 10250
  • etcd nodes
  • controlplane nodes
  • worker nodes
 kubelet
TCP10254
  • controlplane node itself (local traffic, not across nodes)
See Local node traffic		Ingress controller livenessProbe/readinessProbe

worker nodes:
Nodes with the role worker

-
worker nodes - Inbound rules
+

worker nodes - Inbound rules

@@ -184,12 +220,24 @@ + + + + + + + + + + + + @@ -197,7 +245,7 @@
Protocol
  • etcd nodes
  • controlplane nodes
  • worker nodes
 Canal/Flannel VXLAN overlay networking
TCP9099
  • worker node itself (local traffic, not across nodes)
See Local node traffic		Canal/Flannel livenessProbe/readinessProbe
TCP 10250
  • controlplane nodes
 kubelet
TCP10254
  • worker node itself (local traffic, not across nodes)
See Local node traffic		Ingress controller livenessProbe/readinessProbe
TCP/UDP 30000-32767NodePort port range
-
worker nodes - Outbound rules
+

worker nodes - Outbound rules

@@ -223,6 +271,21 @@ + + + + + + + + + + + +
Protocol
  • etcd nodes
  • controlplane nodes
  • worker nodes
 Canal/Flannel VXLAN overlay networking
TCP9099
  • worker node itself (local traffic, not across nodes)
See Local node traffic		Canal/Flannel livenessProbe/readinessProbe
TCP10254
  • worker node itself (local traffic, not across nodes)
See Local node traffic		Ingress controller livenessProbe/readinessProbe

+

Information on local node traffic

+

Kubernetes healthchecks (livenessProbe and readinessProbe) are executed on the host itself. On most nodes, this is allowed by default. When you have applied strict host firewall (i.e. iptables) policies on the node, or when you are using nodes that have multiple interfaces (multihomed), this traffic gets blocked. In this case, you have to explicitely allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as Source or Destination in your security group, that this only applies to the private interface of the nodes/instances. +