Kubernetes集群开启Firewall

骑猪看日落 2023-07-11 12:48 109阅读 0赞

# [Kubernetes集群开启Firewall][Kubernetes_Firewall] #

关于端口的官方说明：[https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/][https_kubernetes.io_docs_setup_production-environment_tools_kubeadm_install-kubeadm]

![format_png][]

### k8s master需要开启以下端口 ###

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 </td> 
 <td> <code>firewall-cmd --permanent --add-port=6443</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=2379-2380</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=10250</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=10251</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=10252</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=10255</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=8472</code><code>/udp</code> <code>firewall-cmd --permanent --add-port=443</code><code>/udp</code> <code>firewall-cmd --permanent --add-port=53</code><code>/udp</code> <code>firewall-cmd --permanent --add-port=53</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=9153</code><code>/tcp</code> <code>firewall-cmd --add-masquerade --permanent</code> <code># only if you want NodePorts exposed on control plane IP as well</code> <code>firewall-cmd --permanent --add-port=30000-32767</code><code>/tcp</code> <code>systemctl restart firewalld</code> </td> 
 </tr> 
 </tbody> 
</table>

### k8s node需要开启以下端口 ###

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 </td> 
 <td> <code>firewall-cmd --permanent --add-port=10250</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=10255</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=8472</code><code>/udp</code> <code>firewall-cmd --permanent --add-port=443</code><code>/udp</code> <code>firewall-cmd --permanent --add-port=30000-32767</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=53</code><code>/udp</code> <code>firewall-cmd --permanent --add-port=53</code><code>/tcp</code> <code>firewall-cmd --permanent --add-port=9153</code><code>/tcp</code> <code>firewall-cmd --add-masquerade --permanent </code> <code>systemctl restart firewalld　　</code> </td> 
 </tr> 
 </tbody> 
</table>

***以下几点需要特别注意：***

8472/udp为flannel的通信端口

443/tcp 为Kubernetes server端口

注意一点：一定要执行以下命令打开NAT，默认是关闭状态，这里踩过坑！！

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 </td> 
 <td> <code>firewall-cmd --add-masquerade --permanent</code> <code># 检查是否允许NAT转发</code> <code>firewall-cmd --query-masquerade</code> <code># 关闭NAT转发</code> <code>firewall-cmd --remove-masquerade</code> </td> 
 </tr> 
 </tbody> 
</table>

如果你使用了istio还有把istio-pilot的端口加到防火墙里：

<table> 
 <tbody> 
 <tr> 
 <td> 1 </td> 
 <td> <code>firewall-cmd --permanent --add-port=15010-15014</code><code>/tcp</code> </td> 
 </tr> 
 </tbody> 
</table>

否则会出现以下报错：

**Envoy proxy is NOT ready**

[Kubernetes_Firewall]: https://www.cnblogs.com/Dev0ps/p/11401530.html
[https_kubernetes.io_docs_setup_production-environment_tools_kubeadm_install-kubeadm]: https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/
[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWcyMDE4LmNuYmxvZ3MuY29tL2Jsb2cvMTI3MTc4Ni8yMDE5MDgvMTI3MTc4Ni0yMDE5MDgyMzE3MzU1MDk0OC02OTg1NTYzMDAucG5n?x-oss-process=image/format,png