Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable Firewall on Node, Add Windows Firewall rules for required ports #2

Merged
merged 4 commits into from
Jun 15, 2017
Merged

Enable Firewall on Node, Add Windows Firewall rules for required ports #2

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ed6c430
Enable Firewall on Node, Add Windows Firewall rules for required ports
raghushantha Jun 5, 2017
e77a2bb
Added comments for firewall rules
raghushantha Jun 9, 2017
897fe12
Allow all traffic; lockdown kubectl Node ports to Master only
raghushantha Jun 13, 2017
6fb551c
Remove & and single quote in comment section
raghushantha Jun 14, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions parts/kuberneteswindowssetup.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,9 +200,20 @@ Get-PodGateway(`$podCIDR)

function
Set-DockerNetwork(`$podCIDR)
{
# Turn off Firewall to enable pods to talk to service endpoints. (Kubelet should eventually do this)
netsh advfirewall set allprofiles state off
{
# Allow all inbound traffic for TCP and UDP for all localports
# We do not want to block customer container deployment port traffic by firewalling
netsh advfirewall firewall add rule name="Container: Allow all TCP inbound connections" dir=in action=allow protocol=TCP
netsh advfirewall firewall add rule name="Container: Allow all UDP inbound connections" dir=in action=allow protocol=UDP

# 4194, 10250, 10255 are local kubelet ports used by Master to manage the nodes
# We want only the Master to have access to these ports
netsh advfirewall firewall add rule name="Node: Allow only K8 Master to access localport 4194" dir=in action=allow protocol=TCP localport=4194 remoteip=`${global:MasterIP}
netsh advfirewall firewall add rule name="Node: Allow only K8 Master to access localport 10250" dir=in action=allow protocol=TCP localport=10250 remoteip=`${global:MasterIP}
netsh advfirewall firewall add rule name="Node: Allow only K8 Master to access localport 10255" dir=in action=allow protocol=TCP localport=10255 remoteip=`${global:MasterIP}

# Turn-on the firewall since we have allowed access to required ports
netsh advfirewall set allprofiles state on
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We explicitly turn off firewall for allprofiles in Set-DockerNetwork. I think it should be ON already but I can't guarantee. Anyway, it doesn't hurt to turn it on.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct, after adding firewall rules it is better to turn on the firewall for all profiles


`$dockerTransparentNet=docker network ls --quiet --filter "NAME=`$global:TransparentNetworkName"
if (`$dockerTransparentNet.length -eq 0)
Expand Down Expand Up @@ -399,4 +410,4 @@ try
catch
{
Write-Error $_
}
}