Rancher nodes:
Nodes running the rancher/rancher
container
Rancher nodes - Inbound rules
Protocol |
Port |
Source |
Description |
TCP |
80 |
- Load balancer/proxy that does external SSL termination
|
Rancher UI/API when external SSL termination is used |
TCP |
443 |
- etcd nodes
- controlplane nodes
- worker nodes
- Hosted/Imported Kubernetes
- any that needs to be able to use UI/API
|
Rancher agent, Rancher UI/API, kubectl |
Rancher nodes - Outbound rules
Protocol |
Port |
Destination |
Description |
TCP |
22 |
- Any node IP from a node created using Node Driver
|
SSH provisioning of nodes using Node Driver |
TCP |
443 |
- 35.160.43.145/32
- 35.167.242.46/32
- 52.33.59.17/32
|
git.rancher.io (catalogs) |
TCP |
6443 |
- Hosted/Imported Kubernetes API
|
Kubernetes apiserver |
etcd nodes:
Nodes with the role etcd
etcd nodes - Inbound rules
Protocol |
Port |
Source |
Description |
TCP |
2379 |
- etcd nodes
- controlplane nodes
|
etcd client requests |
TCP |
2380 |
- etcd nodes
- controlplane nodes
|
etcd peer communication |
UDP |
8472 |
- etcd nodes
- controlplane nodes
- worker nodes
|
Canal/Flannel VXLAN overlay networking |
TCP |
10250 |
|
kubelet |
etcd nodes - Outbound rules
Protocol |
Port |
Destination |
Description |
TCP |
443 |
|
Rancher agent |
TCP |
2379 |
|
etcd client requests |
TCP |
2380 |
|
etcd peer communication |
TCP |
6443 |
|
Kubernetes apiserver |
UDP |
8472 |
- etcd nodes
- controlplane nodes
- worker nodes
|
Canal/Flannel VXLAN overlay networking |
controlplane nodes:
Nodes with the role controlplane
controlplane nodes - Inbound rules
Protocol |
Port |
Source |
Description |
TCP |
80 |
- Any that consumes Ingress services
|
Ingress controller (HTTP) |
TCP |
443 |
- Any that consumes Ingress services
|
Ingress controller (HTTPS) |
TCP |
6443 |
- etcd nodes
- controlplane nodes
- worker nodes
|
Kubernetes apiserver |
UDP |
8472 |
- etcd nodes
- controlplane nodes
- worker nodes
|
Canal/Flannel VXLAN overlay networking |
TCP |
10250 |
|
kubelet |
TCP/UDP |
30000-32767 |
- Any source that consumes NodePort services
|
NodePort port range |
controlplane nodes - Outbound rules
Protocol |
Port |
Destination |
Description |
TCP |
443 |
|
Rancher agent |
TCP |
2379 |
|
etcd client requests |
TCP |
2380 |
|
etcd peer communication |
UDP |
8472 |
- etcd nodes
- controlplane nodes
- worker nodes
|
Canal/Flannel VXLAN overlay networking |
TCP |
10250 |
- etcd nodes
- controlplane nodes
- worker nodes
|
kubelet |
worker nodes:
Nodes with the role worker
worker nodes - Inbound rules
Protocol |
Port |
Source |
Description |
TCP |
80 |
- Any that consumes Ingress services
|
Ingress controller (HTTP) |
TCP |
443 |
- Any that consumes Ingress services
|
Ingress controller (HTTPS) |
UDP |
8472 |
- etcd nodes
- controlplane nodes
- worker nodes
|
Canal/Flannel VXLAN overlay networking |
TCP |
10250 |
|
kubelet |
TCP/UDP |
30000-32767 |
- Any source that consumes NodePort services
|
NodePort port range |
worker nodes - Outbound rules
Protocol |
Port |
Destination |
Description |
TCP |
443 |
|
Rancher agent |
TCP |
6443 |
|
Kubernetes apiserver |
UDP |
8472 |
- etcd nodes
- controlplane nodes
- worker nodes
|
Canal/Flannel VXLAN overlay networking |