add: cilium firewall ports to open

2026-09-14 07:23:48 +00:00
parent 57c42b94ea
commit ee0f1c8c1c
2 changed files with 24 additions and 1 deletions
@@ -26,3 +26,8 @@ k8s_firewall_master_ports:
 k8s_firewall_worker_ports:
  - "10256"
  - "30000:32767"
+k8s_firewall_cilium_udp_ports:
+  - "8472"
+  - "4240"
+k8s_firewall_cilium_tcp_ports:
+  - "4240"
@@ -36,6 +36,24 @@
  loop: "{{ k8s_firewall_worker_ports }}"
  when: inventory_hostname in groups['worker']

+- name: Allow Cilium VXLAN and health check UDP ports from admin subnet
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: udp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_cilium_udp_ports }}"
+
+- name: Allow Cilium health check TCP ports from admin subnet
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_cilium_tcp_ports }}"
+
 - name: Enable ufw and deny incoming by default
  community.general.ufw:
    state: enabled