Firewall

Firewall setup for various components

To set up the Kubernetes cluster, you need to open a few ports on all nodes as mentioned below.

Firewall rules for Kubernetes node

Set up firewall rules on each node according to the following table.

Firewall rules for Load Balancer

Firewall rules for Wireguard

Firewall rules for NFS

Firewall setup

The exact method to set up the firewall rules will vary from cloud to cloud and on-prem. (For example on AWS, EC2 security groups can be used. For on-prem cluster, ufw can be used and so on)

Using Ansible

  • On your machine install ansible

  • Make sure you have SSH access to all nodes of the cluster

  • Create hosts.ini file. Sample given here.

  • Copy ports.yaml file and inspect for any changes w.r.t to above table.

  • Run

ansible-playbook -i hosts.ini ports.yaml

Manual

  • You can use ufw to set up the firewall on each cluster node.

    • SSH into each node, and change to superuser

    • Run the following command for each rule in the above table

      ufw allow from <from-ip-range-allowed> to any port <port/range> proto <tcp/udp>
    • Example:

      ufw allow from any to any port 22 proto tcp
      ufw allow from 10.3.4.0/24 to any port 9345 proto tcp
    • Enable ufw:

      ufw enable
      ufw default deny incoming
  • Additional Reference: RKE2 Networking Requirements

Last updated

Logo

Copyright © 2024 OpenG2P. This work is licensed under Creative Commons Attribution International LicenseCC-BY-4.0 unless otherwise noted.