This message was deleted.
# rke2a
adamant-kite-43734
12/04/2025, 8:56 AMThis message was deleted.
c
creamy-pencil-82913
12/04/2025, 9:11 AM> attackers could reach etcd and api server after container escape.
You can’t segment the agent (worker as you put it) from the apiserver. The kubelet, cni, cpi, csi, and most likely many pods need to talk to the apiserver constantly. This is how Kubernetes works. You cannot have Kubernetes without access to the apiserver.
creamy-pencil-82913
12/04/2025, 9:12 AMHow would you propose to operate your nodes without any access to the apiserver? What would your pods do if they could not interact with it either?
creamy-pencil-82913
12/04/2025, 9:15 AMIf simply having access to the apiserver or etcd ports is sufficient to allow someone to cause 50M damage, you have other problems with your configuration. Both these should be secured via TLS and RBAC out of the box.
s
shy-controller-27659
12/05/2025, 7:42 AMHey @creamy-pencil-82913 Thank you for your answer. Maybe i did not clarify that enough. Of course the worker node can talk with the api server tcp/6443 outbound routing it over layer 3 gateway (firewall) to route between control-plane-vlan and worker-vlan. so minimum requirements should be there in least privilege
but not having it sitting together in one node.
my plan was something like this:
worker out 6443 to api server
api server in worker 10250 for logs, port forwarding etc.
api server etcd 2379/2380
worker dns 53 out
c
creamy-pencil-82913
12/05/2025, 8:12 AMYou can find a list of required ports in the rke2 docs. If you start with everything blocked, and open only those, you'd probably get what you're looking for?
3 Views