public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-24 20:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update docs for embedded etcd ports

Browse Source 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
This commit is contained in:
Brad Davidson
2020-12-10 15:01:03 -08:00
parent 8226554bca
commit 39cb51a1ee
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/k3s/latest/en/installation/installation-requirements/_index.md
+6 -3
View File
@@ -41,21 +41,24 @@ K3s performance depends on the performance of the database. To ensure optimal sp
## Networking
The K3s server needs port 6443 to be accessible by the nodes.
The K3s server needs port 6443 to be accessible by all nodes.
The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s.
If you wish to utilize the metrics server, you will need to open port 10250 on each node.
If you plan on achieving high availability with embedded etcd, server nodes must be accessible to each other on ports 2379 and 2380.
> **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
<figcaption>Inbound Rules for K3s Server Nodes</figcaption>
| Protocol | Port | Source | Description
|-----|-----|----------------|---|
| TCP | 6443 | K3s agent nodes | Kubernetes API
| TCP | 6443 | K3s agent nodes | Kubernetes API Server
| UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN
| TCP | 10250 | K3s server and agent nodes | kubelet
| TCP | 10250 | K3s server and agent nodes | Kubelet metrics
| TCP | 2379-2380 | K3s server nodes | Required only for HA with embedded etcd
Typically all outbound traffic is allowed.