For the complete documentation index, see llms.txt. This page is also available as Markdown.

Ubuntu Firewall configuration

Overview

The firewall follows a default-deny approach:

  • All inbound traffic is denied by default.

  • Only ports required for cluster operation are opened.

  • Firewall rules are managed automatically by Ansible.

  • Existing OpenCRVS-managed rules are removed and recreated during each deployment to ensure configuration consistency.

Unrestricted access

  • SSH: All nodes allow inbound SSH connections on TCP port 22.

  • HTTP/HTTPS: Control plane node (master) allows inbound traffic on 80 and 443 ports. These ports are used by Traefik to expose OpenCRVS services.

Kubernetes API

Control plane node allows access to the Kubernetes API server on TCP port 6443 from:

  • All Kubernetes cluster nodes

  • Additional CIDR ranges specified through the kubernetes_api_allowed_cidrs configuration option

This allows cluster components to communicate with the API server while enabling operators to restrict administrative access to trusted networks.

Internal Cluster Communication

OpenCRVS automatically discovers all Kubernetes node IP addresses and creates firewall rules allowing communication between cluster members only.

The following ports are opened between cluster nodes:

Port
Protocol
Purpose

6443

TCP

Kubernetes API Server

10250

TCP

Kubelet API

10251

TCP

kube-scheduler

10252

TCP

kube-controller-manager

179

TCP/UDP

Calico BGP

4789

UDP

Calico VXLAN overlay networking

7946

TCP/UDP

Cluster networking components

8472

UDP

VXLAN overlay networking

etcd communication ports (2379 and 2380) are not exposed publicly and are intended only for control plane communication within the cluster.

To support Calico networking, inbound traffic is allowed on the following interfaces:

  • cali+

  • vxlan.calico

Configuration options

GitHub variable/secret
Ansible variable
Description

KUBE_API_HOST

kube_api_host

Kubernetes master node IP / Hostname

KUBE_API_ALLOWED_CIDRS

kube_api_allowed_cidrs

Subnets approved to access Kubernetes API server (master). Comma-separated list (e/g: 10.0.0.0/16,192.168.0.0/24)

KUBE_WORKER_NODES

n/a

Kubernetes worker nodes. Comma-separated list (e/g: 10.0.0.2,10.0.0.3,10.0.0.4)

Last updated