我的书签
添加书签
移除书签Rancher Nodes
The following table lists the ports that need to be open to and from nodes that are running the Rancher server.
The port requirements differ based on the Rancher server architecture.
As of Rancher v2.5, Rancher can be installed on any Kubernetes cluster. For Rancher installs on a K3s, RKE, or RKE2 Kubernetes cluster, refer to the tabs below. For other Kubernetes distributions, refer to the distribution’s documentation for the port requirements for cluster nodes.
Click to expand
The K3s server needs port 6443 to be accessible by the nodes.
The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s.
If you wish to utilize the metrics server, you will need to open port 10250 on each node.
The following tables break down the port requirements for inbound and outbound traffic:
Inbound Rules for Rancher Server Nodes
Outbound Rules for Rancher Nodes
| Protocol | Port | Destination | Description |
|---|---|---|---|
| TCP | 22 | Any node IP from a node created using Node Driver | SSH provisioning of nodes using Node Driver |
| TCP | 443 | git.rancher.io | Rancher catalog |
| TCP | 2376 | Any node IP from a node created using Node driver | Docker daemon TLS port used by Docker Machine |
| TCP | 6443 | Hosted/Imported Kubernetes API | Kubernetes API server |
Ports for Rancher Server Nodes on RKE
Click to expand
Typically Rancher is installed on three RKE nodes that all have the etcd, control plane and worker roles.
The following tables break down the port requirements for traffic between the Rancher nodes:
Rules for traffic between Rancher nodes
| Protocol | Port | Description |
|---|---|---|
| TCP | 443 | Rancher agents |
| TCP | 2379 | etcd client requests |
| TCP | 2380 | etcd peer communication |
| TCP | 6443 | Kubernetes apiserver |
| UDP | 8472 | Canal/Flannel VXLAN overlay networking |
| TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe |
| TCP | 10250 | Metrics server communication with all nodes |
| TCP | 10254 | Ingress controller livenessProbe/readinessProbe |
The following tables break down the port requirements for inbound and outbound traffic:
Inbound Rules for Rancher Nodes
| Protocol | Port | Source | Description |
|---|---|---|---|
| TCP | 22 | RKE CLI | SSH provisioning of node by RKE |
| TCP | 80 | Load Balancer/Reverse Proxy | HTTP traffic to Rancher UI/API |
| TCP | 443 |
| HTTPS traffic to Rancher UI/API |
| TCP | 6443 | Kubernetes API clients | HTTPS traffic to Kubernetes API |
Outbound Rules for Rancher Nodes
Ports for Rancher Server Nodes on RancherD or RKE2
The RancherD (or RKE2) server needs port 6443 and 9345 to be accessible by other nodes in the cluster.
All nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used.
If you wish to utilize the metrics server, you will need to open port 10250 on each node.
Important: The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
Inbound Rules for RancherD or RKE2 Server Nodes
| Protocol | Port | Source | Description |
|---|---|---|---|
| TCP | 9345 | RancherD/RKE2 agent nodes | Kubernetes API |
| TCP | 6443 | RancherD/RKE2 agent nodes | Kubernetes API |
| UDP | 8472 | RancherD/RKE2 server and agent nodes | Required only for Flannel VXLAN |
| TCP | 10250 | RancherD/RKE2 server and agent nodes | kubelet |
| TCP | 2379 | RancherD/RKE2 server nodes | etcd client port |
| TCP | 2380 | RancherD/RKE2 server nodes | etcd peer port |
| TCP | 30000-32767 | RancherD/RKE2 server and agent nodes | NodePort port range |
| HTTP | 8080 | Load balancer/proxy that does external SSL termination | Rancher UI/API when external SSL termination is used |
| HTTPS | 8443 |
| Rancher agent, Rancher UI/API, kubectl. Not needed if you have LB doing TLS termination. |
Typically all outbound traffic is allowed.
Ports for Rancher Server in Docker
Click to expand
The following tables break down the port requirements for Rancher nodes, for inbound and outbound traffic:
Inbound Rules for Rancher Node
| Protocol | Port | Source | Description |
|---|---|---|---|
| TCP | 80 | Load balancer/proxy that does external SSL termination | Rancher UI/API when external SSL termination is used |
| TCP | 443 |
| Rancher agent, Rancher UI/API, kubectl |
Outbound Rules for Rancher Node
| Protocol | Port | Source | Description |
|---|---|---|---|
| TCP | 22 | Any node IP from a node created using Node Driver | SSH provisioning of nodes using Node Driver |
| TCP | 443 | git.rancher.io | Rancher catalog |
| TCP | 2376 | Any node IP from a node created using a node driver | Docker daemon TLS port used by Docker Machine |
| TCP | 6443 | Hosted/Imported Kubernetes API | Kubernetes API server |
Downstream Kubernetes Cluster Nodes
Downstream Kubernetes clusters run your apps and services. This section describes what ports need to be opened on the nodes in downstream clusters so that Rancher can communicate with them.
The port requirements differ depending on how the downstream cluster was launched. Each of the tabs below list the ports that need to be opened for different cluster types.
The following diagram depicts the ports that are opened for each .
Port Requirements for the Rancher Management Plane
Click to expand
The following table depicts the port requirements for Rancher Launched Kubernetes with nodes created in an .
Ports for Rancher Launched Kubernetes Clusters using Custom Nodes
Click to expand
The following table depicts the port requirements for with Custom Nodes.
| From / To | Rancher Nodes | etcd Plane Nodes | Control Plane Nodes | Worker Plane Nodes | External Rancher Load Balancer | Internet |
|---|---|---|---|---|---|---|
| Rancher Nodes (1) | git.rancher.io | |||||
| etcd Plane Nodes | 443 TCP (3) | 2379 TCP | 443 TCP | |||
| 2380 TCP | ||||||
| 6443 TCP | ||||||
| 8472 UDP | ||||||
| 4789 UDP (6) | ||||||
| 9099 TCP (4) | ||||||
| Control Plane Nodes | 443 TCP (3) | 2379 TCP | 443 TCP | |||
| 2380 TCP | ||||||
| 6443 TCP | ||||||
| 8472 UDP | ||||||
| 4789 UDP (6) | ||||||
| 10250 TCP | ||||||
| 9099 TCP (4) | ||||||
| 10254 TCP (4) | ||||||
| Worker Plane Nodes | 443 TCP (3) | 6443 TCP | 443 TCP | |||
| 8472 UDP | ||||||
| 4789 UDP (6) | ||||||
| 9099 TCP (4) | ||||||
| 10254 TCP (4) | ||||||
| Kubernetes API Clients | 6443 TCP (5) | |||||
| Workload Clients or Load Balancer | 30000-32767 TCP / UDP (nodeport) | |||||
| 80 TCP (Ingress) | ||||||
| 443 TCP (Ingress) | ||||||
| Notes: 1. Nodes running standalone server or Rancher HA deployment. 2. Required to fetch Rancher chart library. 3. Only without external load balancer in front of Rancher. 4. Local traffic to the node itself (not across nodes). 5. Only if Authorized Cluster Endpoints are activated. 6. Only if using Overlay mode on Windows cluster. | ||||||
Ports for Hosted Kubernetes Clusters
Click to expand
The following table depicts the port requirements for hosted clusters.
| From / To | Rancher Nodes | Hosted / Imported Cluster | External Rancher Load Balancer | Internet |
|---|---|---|---|---|
| Rancher Nodes (1) | Kubernetes API Endpoint Port (2) | git.rancher.io | ||
| 8443 TCP | ||||
| 9443 TCP | ||||
| Hosted / Imported Cluster | 443 TCP (4)(5) | 443 TCP (5) | ||
| Kubernetes API Clients | Cluster / Provider Specific (6) | |||
| Workload Client | Cluster / Provider Specific (7) | |||
| Notes: 1. Nodes running standalone server or Rancher HA deployment. 2. Only for hosted clusters. 3. Required to fetch Rancher chart library. 4. Only without external load balancer. 5. From worker nodes. 6. For direct access to the Kubernetes API without Rancher. 7. Usually Ingress backed by infrastructure load balancer and/or nodeport. | ||||
Ports for Registered Clusters
Note: Registered clusters were called imported clusters before Rancher v2.5.
Click to expand
The following table depicts the port requirements for registered clusters.
| From / To | Rancher Nodes | Hosted / Imported Cluster | External Rancher Load Balancer | Internet |
|---|---|---|---|---|
| Rancher Nodes (1) | Kubernetes API Endpoint Port (2) | git.rancher.io | ||
| 8443 TCP | ||||
| 9443 TCP | ||||
| Hosted / Imported Cluster | 443 TCP (4)(5) | 443 TCP (5) | ||
| Kubernetes API Clients | Cluster / Provider Specific (6) | |||
| Workload Client | Cluster / Provider Specific (7) | |||
| Notes: 1. Nodes running standalone server or Rancher HA deployment. 2. Only for hosted clusters. 3. Required to fetch Rancher chart library. 4. Only without external load balancer. 5. From worker nodes. 6. For direct access to the Kubernetes API without Rancher. 7. Usually Ingress backed by infrastructure load balancer and/or nodeport. | ||||
Other Port Considerations
These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
Local Node Traffic
Ports marked as local traffic (i.e., 9099 TCP) in the above requirements are used for Kubernetes healthchecks ( andreadinessProbe). These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default.
However, this traffic may be blocked when:
- You have applied strict host firewall policies on the node.
- You are using nodes that have multiple interfaces (multihomed).
In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes / instances.
Rancher AWS EC2 Security Group
When using the AWS EC2 node driver to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called rancher-nodes. The following rules are automatically added to this security group.
| Type | Protocol | Port Range | Source/Destination | Rule Type |
|---|---|---|---|---|
| SSH | TCP | 22 | 0.0.0.0/0 | Inbound |
| HTTP | TCP | 80 | 0.0.0.0/0 | Inbound |
| Custom TCP Rule | TCP | 443 | 0.0.0.0/0 | Inbound |
| Custom TCP Rule | TCP | 2376 | 0.0.0.0/0 | Inbound |
| Custom TCP Rule | TCP | 2379-2380 | sg-xxx (rancher-nodes) | Inbound |
| Custom UDP Rule | UDP | 4789 | sg-xxx (rancher-nodes) | Inbound |
| Custom TCP Rule | TCP | 6443 | 0.0.0.0/0 | Inbound |
| Custom UDP Rule | UDP | 8472 | sg-xxx (rancher-nodes) | Inbound |
| Custom TCP Rule | TCP | 10250-10252 | sg-xxx (rancher-nodes) | Inbound |
| Custom TCP Rule | TCP | 10256 | sg-xxx (rancher-nodes) | Inbound |
| Custom TCP Rule | TCP | 30000-32767 | 0.0.0.0/0 | Inbound |
| Custom UDP Rule | UDP | 30000-32767 | 0.0.0.0/0 | Inbound |
| All traffic | All | All | 0.0.0.0/0 | Outbound |
Opening SUSE Linux Ports
SUSE Linux may have a firewall that blocks all ports by default. To open the ports needed for adding the host to a custom cluster,
- SSH into the instance.
Start YaST in text mode:
Navigate to Security and Users > Firewall > Zones:public > Ports. To navigate within the interface, follow the instructions here.
To open the required ports, enter them into the TCP Ports and UDP Ports fields. In this example, ports 9796 and 10250 are also opened for monitoring. The resulting fields should look similar to the following:
TCP Ports22, 80, 443, 2376, 2379, 2380, 6443, 9099, 9796, 10250, 10254, 30000-327678472, 30000-32767
When all required ports are enter, select Accept.
SSH into the instance.
- Edit /
etc/sysconfig/SuSEfirewall2and open the required ports. In this example, ports 9796 and 10250 are also opened for monitoring:FW_SERVICES_EXT_TCP="22 80 443 2376 2379 2380 6443 9099 9796 10250 10254 30000:32767" FW_SERVICES_EXT_UDP="8472 30000:32767" FW_ROUTE=yes - Restart the firewall with the new ports:
SuSEfirewall2
Result: The node has the open ports required to be added to a custom cluster.
