Ubuntu Firewall configuration
Last updated
The firewall follows a default-deny approach:
All inbound traffic is denied by default.
Only ports required for cluster operation are opened.
Firewall rules are managed automatically by Ansible.
Existing OpenCRVS-managed rules are removed and recreated during each deployment to ensure configuration consistency.
SSH: All nodes allow inbound SSH connections on TCP port 22.
HTTP/HTTPS: Control plane node (master) allows inbound traffic on 80 and 443 ports. These ports are used by Traefik to expose OpenCRVS services.
Control plane node allows access to the Kubernetes API server on TCP port 6443 from:
All Kubernetes cluster nodes
Additional CIDR ranges specified through the kubernetes_api_allowed_cidrs configuration option
This allows cluster components to communicate with the API server while enabling operators to restrict administrative access to trusted networks.
OpenCRVS automatically discovers all Kubernetes node IP addresses and creates firewall rules allowing communication between cluster members only.
The following ports are opened between cluster nodes:
6443
TCP
Kubernetes API Server
10250
TCP
Kubelet API
10251
TCP
kube-scheduler
10252
TCP
kube-controller-manager
179
TCP/UDP
Calico BGP
4789
UDP
Calico VXLAN overlay networking
7946
TCP/UDP
Cluster networking components
8472
UDP
VXLAN overlay networking
etcd communication ports (2379 and 2380) are not exposed publicly and are intended only for control plane communication within the cluster.
To support Calico networking, inbound traffic is allowed on the following interfaces:
cali+
vxlan.calico
KUBE_API_HOST
kube_api_host
Kubernetes master node IP / Hostname
KUBE_API_ALLOWED_CIDRS
kube_api_allowed_cidrs
Subnets approved to access Kubernetes API server (master). Comma-separated list (e/g: 10.0.0.0/16,192.168.0.0/24)
KUBE_WORKER_NODES
n/a
Kubernetes worker nodes. Comma-separated list (e/g: 10.0.0.2,10.0.0.3,10.0.0.4)
Last updated