LATEST VERSION: v1.3 - RELEASE NOTES

Pivotal Container Service v1.3

• v1.2
• v1.1
• v1.0

PDF

Firewall Ports and Protocols Requirements

Page last updated:

This topic describes the firewall ports and protocols requirements for using Pivotal Container Service (PKS) on vSphere with NSX-T integration.

In environments with strict inter-network access control policies, firewalls often require conduits to pass communication between system components on a different network or allow interfacing with external systems such as with enterprise applications or the public Internet.

For PKS, we recommend that you disable security policies that filter traffic between the networks supporting the system. When that is not an option, refer to the following table, which identifies the flows between system components in a typical PKS deployment.

Note: You must set the communication path in your firewall settings to accomodate how you elect to control what groups have access to deploy and scale PKS-deployed Kubernetes clusters in your organization. In this case, mirror the settings on the lines below for the Operator –> PKS API server.

You have the option to expose containerized applications, running in a Kubernetes cluster, for external consumption through various ports and methods.

You can enable external access to applications by way of NSX and non-NSX load balancers and ingress. Enabling access to applications through standard Kubernetes load-balancers and ingress controller types allow for specific port and protocol designations, while the NAT function offered through NSX-T will allow external addresses and ports to be automatically mapped and resolved to internal/local addresses and ports.

The NodePort Service type is not supported for PKS deployments on vSphere with NSX-T. Only type:LoadBalancer and Services associated with Ingress rules are supported on vSphere with NSX-T.