public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add info on rancher-nodes security group when using EC2 node driver

Browse Source
This commit is contained in:
Sebastiaan van Steenis
2018-07-25 16:04:23 +02:00
parent 76b5990ddc
commit 9e976a0085
3 changed files with 105 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md
+1 -1
View File
@@ -24,7 +24,7 @@ Use {{< product >}} to create a Kubernetes cluster in Amazon EC2.
See [Example Node IAM policy](#example-node-iam-policy) for an example policy that can be applied to these credentials.
- **Zone and Network** configures the availability zone and network settings for your cluster.
- **Security Groups** creates or configures the security groups applied to your nodes.
- **Security Groups** creates or configures the Security Groups applied to your nodes. Please refer to [Amazon EC2 security group when using Node Driver]({{< baseurl >}}/rancher/v2.x/en/installation/references/#amazonec2-securitygroup-nodedriver) to see what rules are created in the `rancher-nodes` Security Group.
- **Instance** configures the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI.
If you need to pass an **IAM Instance Profile Name** (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example Node IAM policy with PassRole](#example-node-iam-policy-with-passrole) for an example policy.
content/rancher/v2.x/en/installation/references/_index.md
+1
View File
@@ -13,3 +13,4 @@ The following diagram displays the basic port requirements for Rancher. If you n
{{< requirements_ports_rancher >}}
{{< requirements_ports_rke >}}
{{< ports_aws_securitygroup_nodedriver >}}
layouts/shortcodes/ports_aws_securitygroup_nodedriver.html
+103
View File
@@ -0,0 +1,103 @@
<h3 id="amazonec2-securitygroup-nodedriver">Amazon EC2 security group when using Node Driver</h3>
<p>If you are <a href="/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/">Creating an Amazon EC2 Cluster</a>, you can choose to let Rancher create a Security Group called <code>rancher-nodes</code>. The following rules are automatically added to this Security Group.
</p>
<div>
<p><strong>Security group: rancher-nodes</strong></p>
<h4>Inbound rules</h4>
<table>
<tr>
<th>Type</th>
<th>Protocol</th>
<th align="left">Port Range</th>
<th align="left">Source</th>
</tr>
<tr>
<td>SSH</td>
<td>TCP</td>
<td>22</td>
<td>0.0.0.0/0</td>
</tr>
<tr>
<td>HTTP</td>
<td>TCP</td>
<td>80</td>
<td>0.0.0.0/0</td>
</tr>
<tr>
<td>Custom TCP Rule</td>
<td>TCP</td>
<td>443</td>
<td>0.0.0.0/0</td>
</tr>
<tr>
<td>Custom TCP Rule</td>
<td>TCP</td>
<td>2376</td>
<td>0.0.0.0/0</td>
</tr>
<tr>
<td>Custom TCP Rule</td>
<td>TCP</td>
<td>2379-2380</td>
<td>sg-xxx (rancher-nodes)</td>
</tr>
<tr>
<td>Custom UDP Rule</td>
<td>UDP</td>
<td>4789</td>
<td>sg-xxx (rancher-nodes)</td>
</tr>
<tr>
<td>Custom TCP Rule</td>
<td>TCP</td>
<td>6443</td>
<td>0.0.0.0/0</td>
</tr>
<tr>
<td>Custom UDP Rule</td>
<td>UDP</td>
<td>8472</td>
<td>sg-xxx (rancher-nodes)</td>
</tr>
<tr>
<td>Custom TCP Rule</td>
<td>TCP</td>
<td>10250-10252</td>
<td>sg-xxx (rancher-nodes)</td>
</tr>
<tr>
<td>Custom TCP Rule</td>
<td>TCP</td>
<td>10256</td>
<td>sg-xxx (rancher-nodes)</td>
</tr>
<tr>
<td>Custom TCP Rule</td>
<td>TCP</td>
<td>30000-32767</td>
<td>0.0.0.0/0</td>
</tr>
<tr>
<td>Custom UDP Rule</td>
<td>UDP</td>
<td>30000-32767</td>
<td>0.0.0.0/0</td>
</tr>
</table>
<h4>Outbound rules</h4>
<table>
<tr>
<th>Type</th>
<th>Protocol</th>
<th align="left">Port Range</th>
<th align="left">Destination</th>
</tr>
<tr>
<td>All traffic</td>
<td>All</td>
<td>All</td>
<td>0.0.0.0/0</td>
</tr>
</table>
<br/>
</div>