diff --git a/content/k3s/latest/en/installation/installation-requirements/_index.md b/content/k3s/latest/en/installation/installation-requirements/_index.md index 1b6b4c4ab99..796451ac6a3 100644 --- a/content/k3s/latest/en/installation/installation-requirements/_index.md +++ b/content/k3s/latest/en/installation/installation-requirements/_index.md @@ -41,21 +41,24 @@ K3s performance depends on the performance of the database. To ensure optimal sp ## Networking -The K3s server needs port 6443 to be accessible by the nodes. +The K3s server needs port 6443 to be accessible by all nodes. The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s. If you wish to utilize the metrics server, you will need to open port 10250 on each node. +If you plan on achieving high availability with embedded etcd, server nodes must be accessible to each other on ports 2379 and 2380. + > **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
Inbound Rules for K3s Server Nodes
| Protocol | Port | Source | Description |-----|-----|----------------|---| -| TCP | 6443 | K3s agent nodes | Kubernetes API +| TCP | 6443 | K3s agent nodes | Kubernetes API Server | UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN -| TCP | 10250 | K3s server and agent nodes | kubelet +| TCP | 10250 | K3s server and agent nodes | Kubelet metrics +| TCP | 2379-2380 | K3s server nodes | Required only for HA with embedded etcd Typically all outbound traffic is allowed.