rancher
/
rke1-docs
mirror of https://github.com/rancher/rke1-docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add partials for Hugo shortcodes from migration

This commit is contained in:
Billy Tat 2023-07-10 20:02:46 -07:00
parent 43daf0aabd
commit 1cf7800f45
3 changed files with 96 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
docs/os/os.md
View File

@ -290,8 +290,12 @@ For hardware recommendations for large Kubernetes clusters, refer to the officia
For hardware recommendations for etcd clusters in production, refer to the official [etcd documentation](https://etcd.io/docs/v3.5/op-guide/hardware/). For hardware recommendations for etcd clusters in production, refer to the official [etcd documentation](https://etcd.io/docs/v3.5/op-guide/hardware/).
## Ports ## Ports
{{< ports-rke-nodes >}} import PortsRKENodes from '../shared-files/_ports-rke-nodes.md';
{{< requirements_ports_rke >}} import RequirementsPortsRKE from '../shared-files/_requirements_ports_rke.md';
<PortsRKENodes />
<RequirementsPortsRKE />
If you are using an external firewall, make sure you have this port opened between the machine you are using to run `rke` and the nodes that you are going to use in the cluster. If you are using an external firewall, make sure you have this port opened between the machine you are using to run `rke` and the nodes that you are going to use in the cluster.

9
docs/shared-files/_ports-rke-nodes.md Normal file
View File

@ -0,0 +1,9 @@
**RKE node:**
Node that runs the `rke` commands
### RKE node - Outbound rules
| Protocol | Port | Source | Destination | Description |
| --- | --- | --- | --- | --- |
| TCP | 22 | RKE node | Any node configured in Cluster Configuration File | SSH provisioning of node by RKE |
| TCP | 6443 | RKE node | Control plane nodes | Kubernetes API server |

81
docs/shared-files/_requirements_ports_rke.md Normal file
View File

@ -0,0 +1,81 @@
**etcd nodes:** Nodes with the role **etcd**
### etcd nodes - Inbound rules
| Protocol | Port | Source | Description |
| --- | --- | --- | --- |
| TCP | 2376 | Rancher nodes | Docker daemon TLS port used by Docker Machine (only needed when using Node Driver/Templates) |
| TCP | 2379 | <ul><li>etcd nodes</li><li>controlplane nodes</li></ul> | etcd client requests |
| TCP | 2380 | <ul><li>etcd nodes</li><li>controlplane nodes</li></ul> | etcd peer communication |
| UDP | 8472 | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul> | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | <ul><li>etcd node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Canal/Flannel livenessProbe/readinessProbe |
| TCP | 10250 | <ul><li>Metrics server communications with all nodes</li></ul> | kubelet |
### etcd nodes - Outbound rules
| Protocol | Port | Destination | Description |
| --- | --- | --- | --- |
| TCP | 443 | <ul><li>Rancher nodes</li></ul> | Rancher agent |
| TCP | 379| <ul><li>etcd nodes</li></ul> | etcd client requests |
| TCP | 2380 | <ul><li>etcd nodes</li></ul> | etcd peer communication |
| TCP | 6443 | <ul><li>controlplane nodes</li></ul> | Kubernetes apiserver |
| UDP | 8472 | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul> | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | <ul><li>etcd node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Canal/Flannel livenessProbe/readinessProbe |
**controlplane nodes:** Nodes with the role **controlplane**
### controlplane nodes - Inbound rules
| Protocol | Port | Source | Description |
| -------- | ---- | -------| ----------- |
| TCP | 80 | <ul><li>Any that consumes Ingress services</li></ul> | Ingress controller (HTTP) |
| TCP | 443 | <ul><li>Any that consumes Ingress services</li></ul> | Ingress controller (HTTPS) |
| TCP | 2376 | <ul><li>Rancher nodes</li></ul> | Docker daemon TLS port used by Docker Machine (only needed when using Node Driver/Templates) |
| TCP | 6443 | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul> | Kubernetes apiserver |
| UDP | 472 | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul> | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | <ul><li>controlplane node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Canal/Flannel livenessProbe/readinessProbe |
| TCP | 10250 | <ul><li>Metrics server communications with all nodes</li></ul> | kubelet |
| TCP | 10254 | <ul><li>controlplane node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Ingress controller livenessProbe/readinessProbe |
| TCP/UDP | 30000-32767 | <ul><li>Any source that consumes NodePort services</li></ul> | NodePort port range |
### controlplane nodes - Outbound rules
| Protocol | Port | Destination | Description |
| -------- | ---- | ----------- | ----------- |
| TCP | 443 | <ul><li>Rancher nodes</li></ul> | Rancher agent |
| TCP | 2379 | <ul><li>etcd nodes</li></ul> | etcd client requests |
| TCP | 2380 | <ul><li>etcd nodes</li></ul> | etcd peer communication |
| UDP | 8472 | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul> | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | <ul><li>controlplane node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Canal/Flannel livenessProbe/readinessProbe |
| TCP | 10250 | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul> | kubelet | TCP | 10254 | <ul><li>controlplane node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Ingress controller livenessProbe/readinessProbe |
**Worker nodes:** Nodes with the role **worker**
### Worker nodes - Inbound rules
| Protocol | Port | Source | Description |
| -------- | ---- | ------ | ----------- |
| TCP | 22 | <ul><li>**Linux worker nodes only**</li><li>Any network that you want to be able to remotely access this node from.</li></ul> | Remote access over SSH |
| TCP | 3389 | <ul><li>**Windows worker nodes only**</li><li>Any network that you want to be able to remotely access this node from.</li></ul> | Remote access over RDP |
| TCP | 80 | <ul><li>Any that consumes Ingress services</li></ul> | Ingress controller (HTTP) |
| TCP | 443 | <ul><li>Any that consumes Ingress services</li></ul> | Ingress controller (HTTPS) |
| TCP | 2376 | <ul><li>Rancher nodes</li></ul> | Docker daemon TLS port used by Docker Machine only needed when using Node Driver/Templates) |
| UDP | 8472 | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul> | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | <ul><li>worker node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Canal/Flannel livenessProbe/readinessProbe |
| TCP | 10250 | <ul><li>Metrics server communications with all nodes</li></ul> | kubelet |
| TCP | 10254 | <ul><li>worker node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Ingress controller livenessProbe/readinessProbe |
| TCP/UDP | 30000-32767 | <ul><li>Any source that consumes NodePort services</li></ul> | NodePort port range |
### Worker nodes - Outbound rules
| Protocol | Port | Destination | Description |
| -------- | ---- | ----------- | ----------- |
| TCP | 443 | <ul><li>Rancher nodes</li></ul> | Rancher agent |
| TCP | 6443 | <ul><li>controlplane nodes</li></ul> | Kubernetes apiserver |
| UDP | 8472 | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li></ul> | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | <ul><li>worker node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Canal/Flannel livenessProbe/readinessProbe |
| TCP | 10254 | <ul><li>worker node itself ([local traffic](#information-on-local-node-traffic), not across nodes)</li></ul> | Ingress controller livenessProbe/readinessProbe |
### Information on local node traffic
Kubernetes health checks (`livenessProbe` and `readinessProbe`) are executed on the host itself. On most nodes, this is allowed by default. When you have applied strict host firewall (i.e., `ptables`) policies on the node, or when you are using nodes that have multiple interfaces (multi-homed), this traffic gets blocked. In this case, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as Source or Destination in your security group, that this only applies to the private interface of the nodes/instances.