Swimlane HA K8s firewall rules

This document provides the list of all known connections that Swimlane K8s requires to run. The ports listed below need to be opened on masters/workers nodes.

Note: Any additional services are not listed here.

Protocol	Direction	Port Range	Purpose
TCP	Inbound	22	SSH
TCP	Inbound	443	Swimlane application
TCP	Inbound	6443	Kubernetes API server
TCP	Inbound	2379-2380	Etcd server client API
TCP	Inbound	10250-10252	Kubelet API, kube-scheduler, kube-controller-manager
UDP	Inbound	6783-6784	Weave data ports
TCP	Inbound	6783	Weave control port
TCP	Inbound	30000-32767	NodePort services
UDP	Inbound	514	Swimlane (Syslog receiver)
TCP	Inbound	8800	For Replicated deployment - console/dashboard/ui
TCP	Inbound	9870-9881	For Replicated deployment - internal communication

Below is an example of how the above ports are configured using firewalld.

# Change to root $ sudo -i # Install firewalld if not installed, for example on CentOS $ yum install firewalld -y # Enable and start firewalld $ systemctl enable firewalld $ systemctl start firewalld # Create a file and add the rules below $ vi firewalld-rules.sh #!/bin/bash set -e echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf sysctl -p firewall-cmd --zone=external --add-masquerade firewall-cmd --permanent --zone=trusted --add-interface=weave firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="22" accept' firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="443" accept' firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="6443" accept' firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="2379-2380" accept' firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="10250-10252" accept' firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="udp" port="6873-6874" accept' firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="6873" accept' firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="32000-32767" accept' firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="udp" port="514" accept' # For Replicated deployment firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="8800" accept' # For Replicated deployment firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" port protocol="tcp" port="9870-9881" accept' firewall-cmd --reload # Set proper permissions $ chmod 700 firewalld-rules.sh # Run the script to add the rules $ ./firewalld-rules.sh