Network access requirements
Firewalls must not block network connections. This is required for communication between Platform components.
Network interaction diagrams
Shturval v2 with an internal load balancer for KubeAPI, an external load balancer for Ingress, and CoreHA in the client cluster
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Cluster nodes | Load balancer (Ingress) | 80 (optional) | TCP | Cluster interaction with the Ingress controller |
| Cluster nodes | Load balancer (Ingress) | 443 | TCP | Cluster interaction with the Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30080 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 443 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 80 | TCP | Interaction with the cluster Ingress controller |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Management cluster worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Client cluster Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Management cluster interaction with the client cluster |
| Management cluster | Client cluster | 22 | TCP | Client cluster installation over SSH |
| Client cluster | Load balancer | 443 | TCP | Client cluster token validation through the management cluster |
| Management cluster | Load balancer | 443 | TCP | Management cluster token validation |
| Load balancer | Client cluster Control Plane nodes VIP (CoreHA (DNS)) | 1053 | TCP | Dynamic backend addition in HAProxy |
| Client cluster | Load balancer (logs, metrics) | 443 | TCP | Cluster interaction with the Ingress controller for metrics and log forwarding |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
Shturval v2 with an internal load balancer for KubeAPI and an external load balancer for Ingress
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Management cluster Control Plane node | Load balancer (Ingress) | 80 (optional) | TCP | Management cluster interaction with the Ingress controller |
| Management cluster Control Plane node | Load balancer (Ingress) | 443 | TCP | Management cluster interaction with the Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30080 (optional) | TCP | Cluster interaction with the Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 443 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 80 | TCP | Interaction with the cluster Ingress controller |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Client cluster Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Management cluster interaction with the client cluster |
| Management cluster | Client cluster | 22 | TCP | Client cluster installation over SSH |
| Client cluster | Load balancer | 443 | TCP | Client cluster token validation through the management cluster |
| Management cluster | Load balancer | 443 | TCP | Management cluster token validation |
| Client cluster | Load balancer (logs, metrics) | 443 | TCP | Cluster interaction with the Ingress controller for metrics and log forwarding |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
Shturval v2 with an internal load balancer for KubeAPI and Ingress
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Worker nodes VIP (Ingress) | 80 (optional) | TCP | Interaction with the cluster Ingress controller |
| Admin | Worker nodes VIP (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Cluster nodes | VIP Worker node (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Cluster nodes | VIP Worker node (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Client cluster Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Management cluster interaction with the client cluster |
| Management cluster | Client cluster | 22 | TCP | Client cluster installation over SSH |
| Client cluster | VIP Worker node | 443 | TCP | Client cluster token validation through the management cluster |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
Shturval v2 with an external load balancer for KubeAPI and Ingress
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Load balancer (Ingress) | Worker nodes | 30080 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 443 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 80 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (KubeAPI) | Control Plane nodes | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Cluster nodes | Management cluster load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Cluster nodes | Management cluster load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Control Plane nodes | Load balancer (KubeAPI) | 6443 | TCP | Cluster interaction with the Ingress controller |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Worker nodes | Load balancer (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Management cluster | Load balancer (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Management cluster | Client cluster | 22 | TCP | Client cluster installation over SSH |
| Client cluster | Load balancer | 443 | TCP | Client cluster token validation through the management cluster |
| Management cluster | Load balancer | 443 | TCP | Management cluster token validation |
| Client cluster | Load balancer (logs, metrics) | 443 | TCP | Cluster interaction with the Ingress controller for metrics and log forwarding |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
Shturval v2 stand-alone cluster with an internal load balancer for KubeAPI and Ingress
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Worker nodes VIP (Ingress) | 80 (optional) | TCP | Interaction with the cluster Ingress controller |
| Admin | Worker nodes VIP (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Management cluster | Load balancer | 443 | TCP | Management cluster token validation |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Cluster nodes | Control Plane node VIP (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Cluster nodes | Control Plane node VIP (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
Shturval v2 stand-alone cluster with an internal load balancer for KubeAPI and an external load balancer for Ingress
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Cluster nodes | Load balancer (Ingress) | 80 | TCP | Management cluster interaction with the Ingress controller |
| Cluster nodes | Load balancer (Ingress) | 443 | TCP | Management cluster interaction with the Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30080 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 443 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 80 | TCP | Interaction with the cluster Ingress controller |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
Shturval v2 DR platform with an internal load balancer for KubeAPI and an external load balancer for Ingress
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (Ingress) | 443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Cluster nodes | Load balancer (Ingress) | 80 (optional) | TCP | Interaction with the cluster Ingress controller |
| Cluster nodes | Load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30080 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 80 | TCP | Interaction with the cluster Ingress controller |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| DR management cluster worker nodes | S3 (Simple Storage Service) | 9000 | TCP/UDP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| DR management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| DR management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Client cluster Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Management cluster interaction with the client cluster |
| DR management cluster | Client cluster Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Management cluster interaction with the client cluster |
| Management cluster | Client cluster | 22 | TCP | Client cluster installation over SSH |
| DR management cluster | Client cluster | 22 | TCP | Client cluster installation over SSH |
| Client cluster | Load balancer | 443 | TCP | Client cluster token validation through the management cluster |
| Management cluster | Load balancer | 443 | TCP | Management cluster token validation |
| DR management cluster | Load balancer | 443 | TCP | DR management cluster token validation |
| Client cluster | Load balancer (logs, metrics) | 443 | TCP | Cluster interaction with the Ingress controller for metrics and log forwarding |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| DR management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| DR management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| DR management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Load balancer (Ingress) | 80 (optional) | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (Ingress) | 443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Cluster nodes | Load balancer (Ingress) | 80 (optional) | TCP | Interaction with the cluster Ingress controller |
| Cluster nodes | Load balancer (Ingress) | 443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Client cluster | Load balancer | 443 | TCP | Client cluster token validation through the management cluster |
| Management cluster | Load balancer | 443 | TCP | Management cluster token validation |
| Load balancer (Ingress) | Worker nodes | 30080 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 443 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 80 | TCP | Interaction with the cluster Ingress controller |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Client cluster Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Management cluster interaction with the client cluster |
| Management cluster worker nodes | oVirt Engine | 443 | TCP | Cluster creation using the oVirt provider |
| Management cluster worker nodes | vCenter | 443 | TCP | Cluster creation using the vSphere provider |
| Client cluster | Load balancer (logs, metrics) | 443 | TCP | Cluster interaction with the Ingress controller for metrics and log forwarding |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
oVirt, vSphere with an internal load balancer for KubeAPI, external for Ingress, and CoreHA in the client cluster
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Load balancer (Ingress) | Worker nodes | 30080 (optional) | TCP | Management cluster interaction with the Ingress controller |
| Cluster nodes | Load balancer (Ingress) | 80 (optional) | TCP | Interaction with the cluster Ingress controller |
| Cluster nodes | Load balancer (Ingress) | 443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30443 (optional) | TCP | Management cluster interaction with the Ingress controller |
| Load balancer (Ingress) | Worker nodes | 443 | TCP | Management cluster interaction with the Ingress controller |
| Load balancer (Ingress) | Worker nodes | 80 | TCP | Management cluster interaction with the Ingress controller |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Client cluster | Load balancer | 443 | TCP | Client cluster token validation through the management cluster |
| Management cluster | Load balancer | 443 | TCP | Management cluster token validation |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Management cluster worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Client cluster Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Management cluster interaction with the client cluster |
| Load balancer | Client cluster Control Plane nodes VIP (CoreHA (DNS)) | 1053 | TCP | Dynamic backend addition in HAProxy. |
| Management cluster worker nodes | oVirt Engine | 443 | TCP | Cluster creation using the oVirt provider |
| Management cluster worker nodes | vCenter | 443 | TCP | Cluster creation using the vSphere provider |
| Client cluster | Load balancer (logs, metrics) | 443 | TCP | Cluster interaction with the Ingress controller for metrics and log forwarding |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Worker nodes VIP (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Admin | Worker nodes VIP (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Cluster administration and management |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Cluster nodes (Control Plane, Worker) | Control Plane node VIP (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Client cluster Control Plane nodes VIP (KubeAPI) | 6443 | TCP | Management cluster interaction with the client cluster |
| Cluster nodes | Management cluster worker nodes VIP (Ingress) | 80 | TCP | Cluster interaction with the Ingress controller |
| Cluster nodes | Management cluster worker nodes VIP (Ingress) | 443 | TCP | Cluster interaction with the Ingress controller |
| Client cluster | Management cluster worker nodes VIP | 443 | TCP | Client cluster token validation through the management cluster |
| Management cluster worker nodes | oVirt Engine | 443 | TCP | Cluster creation using the oVirt provider |
| Management cluster worker nodes | vCenter | 443 | TCP | Cluster creation using the vSphere provider |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
OpenStack, Basis Dynamix, Yandex Cloud, vCloud Director with an external load balancer for KubeAPI and Ingress
Diagram
Description
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Admin | Load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Admin | Load balancer (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Admin | Management cluster | 22 | TCP | Management cluster installation over SSH |
| Load balancer (Ingress) | Worker nodes | 30080 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 30443 (optional) | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 443 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (Ingress) | Worker nodes | 80 | TCP | Interaction with the cluster Ingress controller |
| Load balancer (KubeAPI) | Control Plane nodes | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Client cluster | Load balancer | 443 | TCP | Client cluster token validation through the management cluster |
| Management cluster | Load balancer | 443 | TCP | Management cluster token validation |
| Cluster nodes | Management cluster load balancer (Ingress) | 80 | TCP | Interaction with the cluster Ingress controller |
| Cluster nodes | Management cluster load balancer (Ingress) | 443 | TCP | Interaction with the cluster Ingress controller |
| Control Plane nodes | Load balancer (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Worker nodes | Load balancer (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Control Plane nodes | Worker nodes (Kubelet) | 10250 | TCP | Kubernetes component for kubelet interaction |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 4240 | TCP | Cluster network (Cilium) |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | ICMP | Cluster network (Cilium) | |
| Cluster nodes (Control Plane, Worker) | Cluster nodes (Control Plane, Worker) | 6081 | UDP | Cluster network (Cilium) |
| Worker nodes | S3 (Simple Storage Service) | 9000 | TCP | S3 storage interaction (Velero) |
| Control Plane node | Control Plane nodes (Etcd) | 2379 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Etcd) | 2380 | TCP | Cluster ETCD node interaction |
| Control Plane node | Control Plane nodes (Kube components) | 10250, 10257, 10259 | TCP | Kubernetes component for kubelet interaction, kube-scheduler, kube-controller-manager |
| Management cluster worker nodes | Active Directory | 389 | TCP/UDP | Active Directory and LDAP interaction |
| Management cluster worker nodes | Active Directory | 636 | TCP | Active Directory and LDAP interaction |
| Management cluster | Load balancer (KubeAPI) | 6443 | TCP | Kubernetes and STD (node configuration management module) components for cluster interaction |
| Management cluster worker nodes | oVirt Engine | 443 | TCP | Cluster creation using the oVirt provider |
| Management cluster worker nodes | vCenter | 443 | TCP | Cluster creation using the vSphere provider |
| Management cluster worker nodes | Yandex Cloud | 443 | TCP | Cluster creation using the Yandex Cloud provider |
| Client cluster | Load balancer (logs, metrics) | 443 | TCP | Cluster interaction with the Ingress controller for metrics and log forwarding |
| Client cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Registry | 443 | TCP | Cluster interaction with an external repository |
| Management cluster | Keycloak, Blitz | 443 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |
| Management cluster | Keycloak, Blitz | 80 | TCP | Platform authentication with an external provider (Keycloak, Blitz) |