This page looks best with JavaScript enabled
Kubernetes Base Environment Requirements
1. Base Packages
| Kubernetes version ≥ 1.18 |
|---|
socat | Required |
conntrack | Required |
ebtables | Optional, but recommended |
ipset | Optional, but recommended |
ipvsadm | Optional, but recommended |
1
| apt-get -y install socat conntrack ebtables ipset ipvsadm
|
2. Port Requirements
2.1 Base Node Services
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| ssh | TCP | allow | 22 | 22 | Node remote management |
| docker | TCP | allow | 2375 | 2376 | Docker remote communication |
| etcd | TCP | allow | 2379 | 2380 | etcd cluster communication |
2.2 Master/Control Plane Components
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| apiserver | TCP | allow | 6443 | 6443 | K8s API Server (HTTPS) |
| apiserver-insecure | TCP | allow | 8080 | 8080 | K8s API Server (HTTP, deprecated) |
| etcd-client | TCP | allow | 2379 | 2379 | etcd client communication |
| etcd-peer | TCP | allow | 2380 | 2380 | etcd inter-node communication |
| scheduler | TCP | allow | 10259 | 10259 | kube-scheduler |
| controller-manager | TCP | allow | 10257 | 10257 | kube-controller-manager |
| kubelet | TCP | allow | 10250 | 10250 | kubelet API |
| kubelet-readonly | TCP | allow | 10255 | 10255 | kubelet read-only port (deprecated) |
| kube-proxy-metrics | TCP | allow | 10249 | 10249 | kube-proxy metrics |
2.3 Worker Node Components
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| kubelet | TCP | allow | 10250 | 10250 | kubelet API |
| kubelet-readonly | TCP | allow | 10255 | 10255 | kubelet read-only port (deprecated) |
| kube-proxy | TCP | allow | 10256 | 10256 | kube-proxy health check |
| nodeport | TCP | allow | 30000 | 32767 | NodePort service range |
2.4 Network Components (CNI)
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| calico-typha | TCP | allow | 5473 | 5473 | Calico Typha |
| calico-node | TCP | allow | 9099 | 9100 | Calico monitoring ports |
| bgp | TCP | allow | 179 | 179 | Calico BGP |
| ipip | IPENCAP/IPIP | allow | — | — | Calico IP-in-IP encapsulation |
| wireguard | UDP | allow | 51820 | 51821 | Calico WireGuard (optional) |
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| flannel-vxlan | UDP | allow | 8472 | 8472 | Flannel VXLAN mode |
| flannel-host-gw | TCP | allow | 8285 | 8285 | Flannel host-gw mode |
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| cilium-agent | TCP | allow | 9876 | 9876 | Cilium Agent |
| cilium-operator | TCP | allow | 9234 | 9234 | Cilium Operator |
| cilium-hubble | TCP | allow | 4244 | 4244 | Hubble gRPC |
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| weave | TCP | allow | 6783 | 6783 | Weave network traffic |
| weave | UDP | allow | 6783 | 6784 | Weave network traffic |
2.5 Storage
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| rpcbind | TCP | allow | 111 | 111 | NFS RPC bind |
| rpcbind | UDP | allow | 111 | 111 | NFS RPC bind |
| nfs | TCP | allow | 2049 | 2049 | NFS service |
| nfs | UDP | allow | 2049 | 2049 | NFS service |
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| iscsi | TCP | allow | 3260 | 3260 | iSCSI target port |
2.6 Service Discovery and DNS
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| coredns | TCP | allow | 53 | 53 | CoreDNS resolution |
| coredns | UDP | allow | 53 | 53 | CoreDNS resolution |
| coredns-metrics | TCP | allow | 9153 | 9153 | CoreDNS metrics |
2.7 Monitoring and Logging
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| prometheus | TCP | allow | 9090 | 9090 | Prometheus server |
| node-exporter | TCP | allow | 9100 | 9100 | Node Exporter |
| kube-state-metrics | TCP | allow | 8080 | 8081 | kube-state-metrics |
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| grafana | TCP | allow | 3000 | 3000 | Grafana Web UI |
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| elasticsearch | TCP | allow | 9200 | 9300 | Elasticsearch |
| kibana | TCP | allow | 5601 | 5601 | Kibana Web UI |
| logstash | TCP | allow | 5044 | 5044 | Logstash Beats |
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| jaeger-query | TCP | allow | 16686 | 16686 | Jaeger UI |
| jaeger-collector | TCP | allow | 14268 | 14268 | Jaeger HTTP |
| jaeger-agent | UDP | allow | 6831 | 6832 | Jaeger UDP |
2.8 Ingress
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| nginx-http | TCP | allow | 80 | 80 | HTTP traffic |
| nginx-https | TCP | allow | 443 | 443 | HTTPS traffic |
| nginx-metrics | TCP | allow | 10254 | 10254 | NGINX metrics |
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| traefik-web | TCP | allow | 8080 | 8080 | Traefik Dashboard |
| traefik-http | TCP | allow | 80 | 80 | HTTP traffic |
| traefik-https | TCP | allow | 443 | 443 | HTTPS traffic |
2.9 Service Mesh
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| istiod | TCP | allow | 15010 | 15017 | Istiod control plane |
| envoy-admin | TCP | allow | 15000 | 15000 | Envoy admin port |
| envoy-outbound | TCP | allow | 15001 | 15001 | Envoy outbound traffic |
| envoy-inbound | TCP | allow | 15006 | 15006 | Envoy inbound traffic |
| istio-proxy | TCP | allow | 15020 | 15020 | Istio Proxy status |
2.10 Load Balancer
| Service | Protocol | Action | Start Port | End Port | Comment |
|---|
| metallb-speaker | TCP | allow | 7472 | 7472 | MetalLB Speaker |
| metallb-webhook | TCP | allow | 9443 | 9443 | MetalLB Webhook |
