This message was deleted.

RKE2 port requirements - if you have not looked at this already: https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-requirements/port-requirements#ports-for-[…]es-on-rke2 Sample firewalld commands - which you maybe able to engineer for ufw. https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/open-ports-with-firewalld I would only open above ports to the cluster nodes not open to the world, and then open only application ports that are needed. Perhaps build a test cluster and test... Bigger question remains; do you trust this cluster anymore?

Thanks @hundreds-evening-84071! Port requirements that’s clear from the list in the documentation and from what you wrote - my nodes should expose only: 80, 443 and >1000 ports for websocket communication needed by applications (did I read it correctly). All outgoing communication could be permited. Firewalld Here is the main confusion… the documentation page starts with > We recommend disabling firewalld. For Kubernetes 1.19.x and higher, firewalld must be turned off. Mine is probably that one where I can’t enable firewall on the server, right?

root@controller:~# kubectl version

WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short. Use --output=yaml|json to get the full version.

Client Version: <http://version.Info|version.Info>{Major:"1", Minor:"27", GitVersion:"v1.27.5", GitCommit:"93e0d7146fb9c3e9f68aa41b2b4265b2fcdb0a4c", GitTreeState:"clean", BuildDate:"2023-08-24T00:48:26Z", GoVersion:"go1.20.7", Compiler:"gc", Platform:"linux/amd64"}

Kustomize Version: v5.0.1

Server Version: <http://version.Info|version.Info>{Major:"1", Minor:"26", GitVersion:"v1.26.9+rke2r1", GitCommit:"d1483fdf7a0578c83523bc1e2212a606a44fd71d", GitTreeState:"clean", BuildDate:"2023-09-13T20:34:35Z", GoVersion:"go1.20.8 X:boringcrypto", Compiler:"gc", Platform:"linux/amd64"}

Trust Yes, you are right and don’t trust this server. I would like to reinstall it but first, I need to know how to setup the FW to prevent the same situation. Thank you!

Firewalld is on the known issues list for RKE2 that you can find at docs.rke2.io too. If you have any network policies already, you can set network policies for the nodes with Calico or Canal and that'll act as a firewall. Warning if you have no network policies is that 0 network policies acts like an allow all firewall, but as soon as you add one it defaults to deny all traffic between namespaces (and maybe more, but definitely between namespaces). So you'll likely break things if you have 0 and try to add node policies in production.

I have not had to do this as my clusters are not on public network... but I thought if there are 2 NICs (public and private networks) there there was a way to set cluster communication on the private network and application access over public? If this is possible then in ufw there maybe a way to trust all traffic on private IPs of the 3 nodes?

I too always kept my clusters non-public. I used a reverse proxy in a DMZ for cluster access, which I also pointed a wildcard DNS record at which makes ingresses easy too.

thanks a lot for your insights.

Also consider a more robust security stance via NeuVector.