Swimlane HA K8s firewall rules

this document provides the list of all known connections that swimlane k8s requires to run the ports listed below need to be opened on masters/workers nodes note any additional services are not listed here protocol direction port range purpose tcp inbound 22 ssh tcp inbound 443 swimlane application tcp inbound 6443 kubernetes api server tcp inbound 2379 2380 etcd server client api tcp inbound 10250 10252 kubelet api, kube scheduler, kube controller manager udp inbound 6783 6784 weave data ports tcp inbound 6783 weave control port tcp inbound 30000 32767 nodeport services udp inbound 514 swimlane (syslog receiver) tcp inbound 8800 for replicated deployment console/dashboard/ui tcp inbound 9870 9881 for replicated deployment internal communication below is an example of how the above ports are configured using firewalld \# change to root $ sudo i \# install firewalld if not installed, for example on centos $ yum install firewalld y \# enable and start firewalld $ systemctl enable firewalld $ systemctl start firewalld \# create a file and add the rules below $ vi firewalld rules sh \#!/bin/bash set e echo "net ipv4 ip forward = 1" >> /etc/sysctl conf sysctl p firewall cmd zone=external add masquerade firewall cmd permanent zone=trusted add interface=weave firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="22" accept' firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="443" accept' firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="6443" accept' firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="2379 2380" accept' firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="10250 10252" accept' firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="udp" port="6873 6874" accept' firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="6873" accept' firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="32000 32767" accept' firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="udp" port="514" accept' \# for replicated deployment firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="8800" accept' \# for replicated deployment firewall cmd permanent zone=public add rich rule=' rule family="ipv4" port protocol="tcp" port="9870 9881" accept' firewall cmd reload \# set proper permissions $ chmod 700 firewalld rules sh \# run the script to add the rules $ /firewalld rules sh