diff --git a/content/rancher/v2.x/en/admin-settings/authentication/azure-ad/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/azure-ad/_index.md index be1486ea00a..d9ac8b37d75 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/azure-ad/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/azure-ad/_index.md @@ -98,7 +98,7 @@ Next, set API permissions for Rancher within Azure.
- **Access the directory as the signed-in user** - **Read directory data** - - **Read all groups** + - **Read all groups**π - **Read all users' full profiles** - **Read all users' basic profiles** - **Sign in and read user profile** diff --git a/content/rancher/v2.x/en/installation/references/_index.md b/content/rancher/v2.x/en/installation/references/_index.md index 3dcbb42a032..b0dedf04dd4 100644 --- a/content/rancher/v2.x/en/installation/references/_index.md +++ b/content/rancher/v2.x/en/installation/references/_index.md @@ -11,47 +11,61 @@ To operate properly, Rancher requires a number of ports to be open on Rancher no The following table lists the ports that need to be open to/from nodes that are running the `rancher/rancher` container ([Single Node Install]({{< baseurl >}}/rancher/v2.x/en/installation/single-node-install/)) or `cattle` deployment pods ([High Availability Install]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install/)). -| Protocol | Port | Source | Destination | Description | -|:--------:|:-----------------:|----------------------------------------------------------------------------------------------------------|----------------------------------------------------------|--------------------------------------------| -| TCP | 80 | Load balancer/reverse proxy | - | HTTP traffic to Rancher UI/API | -| TCP | 443 | Load balancer/reverse proxy
Otherwise IPs of all cluster nodes and other Rancher API/UI clients. | - | HTTPS traffic to Rancher UI/API | -| TCP | 443 | - | 35.160.43.145
35.167.242.46
52.33.59.17 | Rancher catalog (git.rancher.io) | -| TCP | 22 | - | Any node created using Node Driver | SSH provisioning of node by Node Driver | -| TCP | 2376 | - | Any node created using Node Driver | Docker daemon TLS port used by Node Driver | -| TCP | Provider dependent| - | Port of the Kubernetes API Endpoint in Hosted Clusters | Kubernetes API | - ----- +{{< ports-rancher-nodes >}} ## Kubernetes Cluster Nodes The required ports for cluster nodes vary across different methods for creating clusters. -### Hosted/Imported Kubernetes Clusters +>**Tip:** +> +>If security isn't a large concern and you're okay with opening a few additional ports, you can use the table in [Commonly Used Ports](#commonly-used-ports) as your port reference instead of the comprehensive tables below. -The following table depicts the port requirements for [Hosted]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters) and [Imported]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/) clusters. +{{% tabs %}} -![Hosted/Imported Port Requirements]({{< baseurl >}}/img/rancher/port-table-hosted-imported.png) - -### Rancher Launched Kubernetes Cluster (Instrastructure Nodes) +{{% tab "IaaS Clusters" %}} The following table depicts the port requirements for [Rancher Launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/). >**Note:** >The required ports are automatically opened by Rancher during creation of clusters in cloud providers like Amazon EC2 or DigitalOcean. -![RKE Infrastructure Port Requirements]({{< baseurl >}}/img/rancher/port-table-infrastructure-nodes.png) +{{< ports-iaas-nodes >}} -### Rancher Launched Kubernetes Cluster (Custom Nodes) +{{% /tab %}} + +{{% tab "Custom Cluster" %}} The following table depicts the port requirements for [Rancher Launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with [Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/). -![RKE Custom Port Requirements]({{< baseurl >}}/img/rancher/port-table-custom-nodes.png) +{{< ports-custom-nodes >}} -## Annex +{{% /tab %}} -### Port Descriptions +{{% tab "Hosted Clusters" %}} -Description of common ports referenced in the above requirements. +The following table depicts the port requirements for [hosted clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters). + +{{< ports-imported-hosted >}} + +{{% /tab %}} + +{{% tab "Imported Clusters" %}} + +The following table depicts the port requirements for [imported clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/). + +{{< ports-imported-hosted >}} + +{{% /tab %}} + +{{% /tabs %}} + + +## Other Port Considerations + +### Commonly Used Ports + +These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is. | Protocol | Port | Description | |:--------: |:----------------: |------------------------------------------------- | @@ -70,7 +84,14 @@ Description of common ports referenced in the above requirements. ### Local Node Traffic Ports marked as `local traffic` in the above requirements (e.g. `9099/tcp`) are used for Kubernetes healthchecks (`livenessProbe` and`readinessProbe`). -These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default. When you have applied strict host firewall policies on the node, or when you are using nodes that have multiple interfaces (multihomed), this traffic may get blocked. In this case, you have to explicitely allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as Source or Destination in your security group, that this only applies to the private interface of the nodes/instances. +These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default. + +However, this traffic may be blocked when: + +- You have applied strict host firewall policies on the node. +- You are using nodes that have multiple interfaces (multihomed). + +In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes/instances. ### Rancher AWS EC2 security group diff --git a/layouts/shortcodes/ports-custom-nodes.html b/layouts/shortcodes/ports-custom-nodes.html new file mode 100644 index 00000000000..481ce789a97 --- /dev/null +++ b/layouts/shortcodes/ports-custom-nodes.html @@ -0,0 +1,181 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
From / ToRancher Nodesetcd Plane NodesControl Plane NodesWorker Plane NodesExternal Load BalancerInternet
Rancher Nodes (1)git.rancher.io (2):
35.160.43.145:32
35.167.242.46:32
52.33.59.17:32
etcd Plane Nodes443 TCP (3)2379 TCP443 TCP
2380 TCP
6443 TCP
8472 UDP
9099 TCP (4)
Control Plane Nodes443 TCP (3)2379 TCP443 TCP
2380 TCP
6443 TCP
8472 UDP
10250 TCP
9099 TCP (4)
10254 TCP (4)
Worker Plane Nodes443 TCP (3)6443 TCP443 TCP
8472 UDP
9099 TCP (4)
10254 TCP (4)
External Load Balancer (5)80 TCP
443 TCP (6)
API / UI Clients80 TCP (3)80 TCP
443 TCP (3)443 TCP
Workload Clients30000-32767 TCP/UDP
(nodeport)
80 TCP (Ingress)
443 TCP (Ingress)
Notes:

1. Nodes running standalone server or Rancher HA deployment.
2. Required to fetch Rancher chart library.
3. Only without external load balancer.
4. Local traffic to the node itself (not across nodes).
5. Load balancer / proxy that handles tragging to the Rancher UI / API.
6. Only if SSL is not terminated at external load balancer.
\ No newline at end of file diff --git a/layouts/shortcodes/ports-iaas-nodes.html b/layouts/shortcodes/ports-iaas-nodes.html new file mode 100644 index 00000000000..284a32a5b25 --- /dev/null +++ b/layouts/shortcodes/ports-iaas-nodes.html @@ -0,0 +1,184 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
From / ToRancher Nodesetcd Plane NodesControl Plane NodesWorker Plane NodesExternal Load BalancerInternet
Rancher Nodes (1)22 TCPgit.rancher.io (2):
35.160.43.145:32
35.167.242.46:32
52.33.59.17:32
2376 TCP
etcd Plane Nodes443 TCP (3)2379 TCP443 TCP
2380 TCP
6443 TCP
8472 TCP
9099 TCP (4)
Control Plane Nodes443 TCP (3)2379 TCP443 TCP
2380 TCP
6443 TCP
8472 UDP
10250 TCP
9099 TCP (4)
10254 TCP (4)
Worker Plane Nodes443 TCP (3)6443 TCP443 TCP
8472 UDP
9099 TCP (4)
10254 TCP (4)
External Load Balancer (5)80 TCP
443 TCP (6)
API / UI Clients80 TCP (3)80 TCP
443 TCP (3)443 TCP
Workload Clients30000-32767 TCP/UDP
(nodeport)
80 TCP (Ingress)
443 TCP (Ingress)
Notes:

1. Nodes running standalone server or Rancher HA deployment.
2. Required to fetch Rancher chart library.
3. Only without external load balancer.
4. Local traffic to the node itself (not across nodes).
5. Load balancer / proxy that handles tragging to the Rancher UI / API.
6. Only if SSL is not terminated at external load balancer.
\ No newline at end of file diff --git a/layouts/shortcodes/ports-imported-hosted.html b/layouts/shortcodes/ports-imported-hosted.html new file mode 100644 index 00000000000..b8db5b42001 --- /dev/null +++ b/layouts/shortcodes/ports-imported-hosted.html @@ -0,0 +1,51 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
From / ToRancher NodesHosted / Imported ClusterExternal Load BalancerInternet
Rancher Nodes (1)Kubernetes API
Endpoint Port (2)		git.rancher.io (3):
35.160.43.145/32
35.167.242.46/32
52.33.59.17/32
Hosted / Imported Cluster443 TCP (4)(5)443 TCP (5)
External Load Balancer (5)80 TCP
443 TCP (6)
API / UI Clients80 TCP (4)
443 TCP (4)		80 TCP
443 TCP
Workload ClientCluster / Provider Specific (7)
Notes:

1. Nodes running standalone server or Rancher HA deployment.
2. Only for hosted clusters.
3. Required to fetch Rancher chart library.
4. Only without external load balancer.
5. From worker nodes.
6. Only if SSL is not terminated at external load balancer.
7. Usually Ingress backed by infrastructure load balancer and/or nodeport.
\ No newline at end of file diff --git a/layouts/shortcodes/ports-rancher-nodes.html b/layouts/shortcodes/ports-rancher-nodes.html new file mode 100644 index 00000000000..ff28b8285af --- /dev/null +++ b/layouts/shortcodes/ports-rancher-nodes.html @@ -0,0 +1,56 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Port Requirements for Hosted / Imported Clusters
ProtocolPortSourceDestinationDescription
TCP80Load Balancer / Reverse ProxyHTTP traffic to Rancher UI / API.
TCP443Load Balancer / Reverse Proxy

Otherwise IPs of all cluster nodes and other Rancher API / UI clients.		HTTPS traffic to Rancher UI / API.
TCP44335.160.43.145
35.167.242.46
52.33.59.17		Rancher catalog (git.rancher.io).
TCP22Any node created using node driver.SSH provisioning of node by node driver.
TCP2376Any node created using node driver.Docker daemon TLS port used by node driver.
TCPProvider DependentPort of the Kubernetes API endpoint in hosted clusters.Kubernetes API.
\ No newline at end of file