This message was deleted.
# generala
adamant-kite-43734
06/26/2024, 11:40 AMThis message was deleted.
h
hundreds-evening-84071
06/26/2024, 12:22 PMt
tall-hydrogen-17043
06/26/2024, 1:18 PMThat seems more like configurations in rancher-nodes. This is for nodes in a cluster that is administered by Rancher. That cluster is separated from rancher cluster.
h
hundreds-evening-84071
06/26/2024, 1:21 PMyou still need to open appropriate firewall ports for downstream clusters - rancher is not going to modify firewall ports
hundreds-evening-84071
06/26/2024, 1:45 PMthis doc has inbound rules for k3s: https://docs.k3s.io/installation/requirements?_highlight=firewa#inbound-rules-for-k3s-nodes
If you are running RKE2 or RKE1, you will find similar doc for them
t
tall-hydrogen-17043
06/27/2024, 7:41 AMMaybe you are right, I don't get everything you are writing. But just to clarify.
I have my rancher cluster and I have another cluster. Maybe that is called downstream cluster.
It is made of 3 nodes, 2 nodes have ufw disabled and 1 has ufw enabled.
If my cluster agent is running on the pod with ufw enabled it says:
ERROR: https://[my hostname].internal/ping is not accessible (Could not resolve host: [my hostname].internal)
If I disable ufw on that node it starts working.
I have found some posts that experience the same problem and they are talking about:
dnsPolicy: ClusterFirst
Which seems to be what the cluster agent is using.
If I change that to Default it starts working.
But I dont want to change default settings for the cluster agent.
I would like to know how to configure the ufw on nodes in my downstream cluster to allow traffic to my rancher cluster even with ClusterFirst as dnsPolicy.
h
hundreds-evening-84071
06/27/2024, 1:06 PMI have my rancher cluster and I have another cluster. Maybe that is called downstream cluster.If this "another cluster" was created from Rancher UI, then yes that is downstream cluster
hundreds-evening-84071
06/27/2024, 1:08 PM> If my cluster agent is running on the pod with ufw enabled it says:
> ERROR: https://[my hostname].internal/ping is not accessible (Could not resolve host: [my hostname].internal)
>
> If I disable ufw on that node it starts working.
I am not familiar with UFW...
but, lets take rancher out of the picture...
from node where UFW is enabled, can you do:
Copy code
nslookup [my hostname].internal
ping [my hostname].internal
nc -v [my hostname].internal 6443 ## this is for k3s (for rke2 its port 9345)34 Views