Firewall

To set up the Kubernetes cluster, you need to open a few ports on all nodes as mentioned below.

Firewall rules for Kubernetes node

Set up firewall rules on each node according to the following table.

Firewall rules for Load Balancer

Firewall rules for Wireguard

Firewall rules for NFS

Firewall setup

The exact method to set up the firewall rules will vary from cloud to cloud and on-prem. (For example on AWS, EC2 security groups can be used. For on-prem cluster, ufw can be used and so on)

Using Ansible

• On your machine install ansible

• Make sure you have SSH access to all nodes of the cluster

• Create hosts.ini file. Sample given here.

• Copy ports.yaml file and inspect for any changes w.r.t to above table.

• Run

ansible-playbook -i hosts.ini ports.yaml

Manual

• You can use ufw to set up the firewall on each cluster node.

  • SSH into each node, and change to superuser

  • Run the following command for each rule in the above table

    Copy

    ufw allow from <from-ip-range-allowed> to any port <port/range> proto <tcp/udp>

  • Example:

    Copy

    ufw allow from any to any port 22 proto tcp
    ufw allow from 10.3.4.0/24 to any port 9345 proto tcp

  • Enable ufw:

    Copy

    ufw enable
    ufw default deny incoming

• Additional Reference: RKE2 Networking Requirements