mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-24 20:18:18 +00:00
Denise
@@ -5,13 +5,110 @@ aliases:
|
||||
- /rancher/v2.x/en/hosts/amazon/#required-ports-for-rancher-to-work/
|
||||
---
|
||||
|
||||
To operate properly, Rancher requires certain ports to be open on your nodes. During creation of clusters using a cloud service (like Amazon EC2 or DigitalOcean), Rancher opens these ports for you.
|
||||
To operate properly, Rancher requires a number of ports to be open on Rancher nodes and Kubernetes cluster nodes.
|
||||
|
||||
The ports that Rancher opens change according to the type of machines hosting your cluster nodes. The following diagram depicts the ports that are opened for each [cluster type]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning).
|
||||
## Rancher Nodes
|
||||
|
||||
<sup>Cluster Type Port Requirements</sup>
|
||||
|
||||
The following table lists the ports that need to be open to and from nodes that are running the Rancher server container for [single node installs]({{< baseurl >}}/rancher/v2.x/en/installation/single-node-install/) or pods for [high availability installs]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install/).
|
||||
|
||||
{{< requirements_ports_rancher >}}
|
||||
{{< requirements_ports_rke >}}
|
||||
{{< ports_aws_securitygroup_nodedriver >}}
|
||||
{{< ports-rancher-nodes >}}
|
||||
|
||||
## Kubernetes Cluster Nodes
|
||||
|
||||
The ports required to be open for cluster nodes changes depending on how the cluster was launched. Each of the tabs below list the ports that need to be opened for different [cluster creation options]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-options).
|
||||
|
||||
>**Tip:**
|
||||
>
|
||||
>If security isn't a large concern and you're okay with opening a few additional ports, you can use the table in [Commonly Used Ports](#commonly-used-ports) as your port reference instead of the comprehensive tables below.
|
||||
|
||||
{{% tabs %}}
|
||||
|
||||
{{% tab "Node Pools" %}}
|
||||
|
||||
The following table depicts the port requirements for [Rancher Launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
|
||||
|
||||
>**Note:**
|
||||
>The required ports are automatically opened by Rancher during creation of clusters in cloud providers like Amazon EC2 or DigitalOcean.
|
||||
|
||||
{{< ports-iaas-nodes >}}
|
||||
|
||||
{{% /tab %}}
|
||||
|
||||
{{% tab "Custom Nodes" %}}
|
||||
|
||||
The following table depicts the port requirements for [Rancher Launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with [Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/).
|
||||
|
||||
{{< ports-custom-nodes >}}
|
||||
|
||||
{{% /tab %}}
|
||||
|
||||
{{% tab "Hosted Clusters" %}}
|
||||
|
||||
The following table depicts the port requirements for [hosted clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters).
|
||||
|
||||
{{< ports-imported-hosted >}}
|
||||
|
||||
{{% /tab %}}
|
||||
|
||||
{{% tab "Imported Clusters" %}}
|
||||
|
||||
The following table depicts the port requirements for [imported clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/).
|
||||
|
||||
{{< ports-imported-hosted >}}
|
||||
|
||||
{{% /tab %}}
|
||||
|
||||
{{% /tabs %}}
|
||||
|
||||
|
||||
## Other Port Considerations
|
||||
|
||||
### Commonly Used Ports
|
||||
|
||||
These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
|
||||
|
||||
| Protocol | Port | Description |
|
||||
|:--------: |:----------------: |------------------------------------------------- |
|
||||
| TCP | 22 | Node driver SSH provisioning |
|
||||
| TCP | 2376 | Node driver Docker daemon TLS port |
|
||||
| TCP | 2379 | etcd client requests |
|
||||
| TCP | 2380 | etcd peer communication |
|
||||
| UDP | 8472 | Canal/Flannel VXLAN overlay networking |
|
||||
| TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe |
|
||||
| TCP | 10250 | kubelet API |
|
||||
| TCP | 10254 | Ingress controller livenessProbe/readinessProbe |
|
||||
| TCP/UDP | 30000-</br>32767 | NodePort port range |
|
||||
|
||||
----
|
||||
|
||||
### Local Node Traffic
|
||||
|
||||
Ports marked as `local traffic` (i.e., `9099 TCP`) in the above requirements are used for Kubernetes healthchecks (`livenessProbe` and`readinessProbe`).
|
||||
These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default.
|
||||
|
||||
However, this traffic may be blocked when:
|
||||
|
||||
- You have applied strict host firewall policies on the node.
|
||||
- You are using nodes that have multiple interfaces (multihomed).
|
||||
|
||||
In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes / instances.
|
||||
|
||||
### Rancher AWS EC2 security group
|
||||
|
||||
When using the [AWS EC2 node driver]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called `rancher-nodes`. The following rules are automatically added to this security group.
|
||||
|
||||
| Type | Protocol | Port Range | Source/Destination | Rule Type |
|
||||
|-----------------|:--------:|:-----------:|------------------------|:---------:|
|
||||
| SSH | TCP | 22 | 0.0.0.0/0 | Inbound |
|
||||
| HTTP | TCP | 80 | 0.0.0.0/0 | Inbound |
|
||||
| Custom TCP Rule | TCP | 443 | 0.0.0.0/0 | Inbound |
|
||||
| Custom TCP Rule | TCP | 2376 | 0.0.0.0/0 | Inbound |
|
||||
| Custom TCP Rule | TCP | 2379-2380 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom UDP Rule | UDP | 4789 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom TCP Rule | TCP | 6443 | 0.0.0.0/0 | Inbound |
|
||||
| Custom UDP Rule | UDP | 8472 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom TCP Rule | TCP | 10250-10252 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom TCP Rule | TCP | 10256 | sg-xxx (rancher-nodes) | Inbound |
|
||||
| Custom TCP Rule | TCP | 30000-32767 | 30000-32767 | Inbound |
|
||||
| Custom UDP Rule | UDP | 30000-32767 | 30000-32767 | Inbound |
|
||||
| All traffic | All | All | 0.0.0.0/0 | Outbound |
|
||||
|
||||
@@ -0,0 +1,181 @@
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>From / To</th>
|
||||
<th>Rancher Nodes</th>
|
||||
<th>etcd Plane Nodes</th>
|
||||
<th>Control Plane Nodes</th>
|
||||
<th>Worker Plane Nodes</th>
|
||||
<th>External Load Balancer</th>
|
||||
<th>Internet</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td >Rancher Nodes <sup>(1)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">git.rancher.io <sup>(2)</sup>:<br>35.160.43.145:32<br>35.167.242.46:32<br>52.33.59.17:32</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="5">etcd Plane Nodes</td>
|
||||
<td rowspan="5" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">2379 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td rowspan="5" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">2380 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="7">Control Plane Nodes</td>
|
||||
<td rowspan="7" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">2379 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td rowspan="7" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">2380 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">10250 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">10254 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="4">Worker Plane Nodes</td>
|
||||
<td rowspan="4" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
|
||||
<td></td>
|
||||
<td rowspan="4" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">10254 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="2">External Load Balancer <sup>(5)</sup></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(6)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="2">API / UI Clients</td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP <sup>(3)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP<br></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="3">Workload Clients</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">30000-32767 TCP / UDP<br>(nodeport)</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td colspan="2" style="background-color: #3497DA; color:#ffffff;">80 TCP (Ingress)</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td colspan="2" style="background-color: #3497DA; color:#ffffff;">443 TCP (Ingress)</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="7">Notes:<br><br>1. Nodes running standalone server or Rancher HA deployment.<br>2. Required to fetch Rancher chart library.<br>3. Only without external load balancer.<br>4. Local traffic to the node itself (not across nodes).<br>5. Load balancer / proxy that handles tragging to the Rancher UI / API.<br>6. Only if SSL is not terminated at external load balancer.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@@ -0,0 +1,184 @@
|
||||
<table style="border-style:solid;">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>From / To</th>
|
||||
<th>Rancher Nodes</th>
|
||||
<th>etcd Plane Nodes</th>
|
||||
<th>Control Plane Nodes</th>
|
||||
<th>Worker Plane Nodes</th>
|
||||
<th>External Load Balancer</th>
|
||||
<th>Internet</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td rowspan="2">Rancher Nodes <sup>(1)</sup></td>
|
||||
<td></td>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">22 TCP</td>
|
||||
<td></td>
|
||||
<td rowspan="2" style="background-color: #3497DA; color:#ffffff;">git.rancher.io <sup>(2)</sup>:<br>35.160.43.145:32<br>35.167.242.46:32<br>52.33.59.17:32</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">2376 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="5">etcd Plane Nodes</td>
|
||||
<td rowspan="5" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">2379 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td rowspan="5" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">2380 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="7">Control Plane Nodes</td>
|
||||
<td rowspan="7" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">2379 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td rowspan="7" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">2380 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">10250 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">10254 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="4">Worker Plane Nodes</td>
|
||||
<td rowspan="4" style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">6443 TCP</td>
|
||||
<td></td>
|
||||
<td rowspan="4" style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="3" style="background-color: #3497DA; color:#ffffff;">8472 UDP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">9099 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">10254 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="2">External Load Balancer <sup>(5)</sup></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(6)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="2">API / UI Clients</td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP <sup>(3)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP<br></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(3)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="3">Workload Clients</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">30000-32767 TCP / UDP<br>(nodeport)</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td colspan="2" style="background-color: #3497DA; color:#ffffff;">80 TCP (Ingress)</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td colspan="2" style="background-color: #3497DA; color:#ffffff;">443 TCP (Ingress)</td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="7">Notes:<br><br>1. Nodes running standalone server or Rancher HA deployment.<br>2. Required to fetch Rancher chart library.<br>3. Only without external load balancer.<br>4. Local traffic to the node itself (not across nodes).<br>5. Load balancer / proxy that handles tragging to the Rancher UI / API.<br>6. Only if SSL is not terminated at external load balancer.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@@ -0,0 +1,51 @@
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>From / To</th>
|
||||
<th>Rancher Nodes</th>
|
||||
<th>Hosted / Imported Cluster</th>
|
||||
<th>External Load Balancer</th>
|
||||
<th>Internet</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>Rancher Nodes <sup>(1)</sup></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">Kubernetes API <br>Endpoint Port <sup>(2)</sup></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">git.rancher.io <sup>(3)</sup>:<br>35.160.43.145:32<br>35.167.242.46:32<br>52.33.59.17:32</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Hosted / Imported Cluster</td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(4)(5)</sup></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">443 TCP <sup>(5)</sup></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>External Load Balancer <sup>(5)</sup></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP<br>443 TCP <sup>(6)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>API / UI Clients</td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP <sup>(4)</sup><br>443 TCP <sup>(4)</sup></td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">80 TCP<br>443 TCP</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Workload Client</td>
|
||||
<td></td>
|
||||
<td style="background-color: #3497DA; color:#ffffff;">Cluster / Provider Specific <sup>(7)</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="5">Notes:<br><br>1. Nodes running standalone server or Rancher HA deployment.<br>2. Only for hosted clusters.<br>3. Required to fetch Rancher chart library.<br>4. Only without external load balancer.<br>5. From worker nodes.<br>6. Only if SSL is not terminated at external load balancer.<br>7. Usually Ingress backed by infrastructure load balancer and/or nodeport.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@@ -0,0 +1,55 @@
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Protocol</th>
|
||||
<th>Port</th>
|
||||
<th>Source</th>
|
||||
<th>Destination</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>TCP</td>
|
||||
<td>80</td>
|
||||
<td>Load Balancer / Reverse Proxy</td>
|
||||
<td></td>
|
||||
<td>HTTP traffic to Rancher UI / API.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>TCP</td>
|
||||
<td>443</td>
|
||||
<td>Load Balancer / Reverse Proxy<br><br>Otherwise IPs of all cluster nodes and other Rancher API / UI clients.</td>
|
||||
<td></td>
|
||||
<td>HTTPS traffic to Rancher UI / API.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>TCP</td>
|
||||
<td>443</td>
|
||||
<td></td>
|
||||
<td>35.160.43.145<br>35.167.242.46<br>52.33.59.17</td>
|
||||
<td>Rancher catalog (git.rancher.io).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>TCP</td>
|
||||
<td>22</td>
|
||||
<td></td>
|
||||
<td>Any node created using node driver.</td>
|
||||
<td>SSH provisioning of node by node driver.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>TCP</td>
|
||||
<td>2376</td>
|
||||
<td></td>
|
||||
<td>Any node created using node driver.</td>
|
||||
<td>Docker daemon TLS port used by node driver.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>TCP</td>
|
||||
<td>Provider Dependent</td>
|
||||
<td></td>
|
||||
<td>Port of the Kubernetes API endpoint in hosted clusters.</td>
|
||||
<td>Kubernetes API.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
Reference in New Issue
Block a user