ansible/kubernetes/roles/k8s_node/defaults/main.yml

@@ -25,4 +25,9 @@ k8s_firewall_master_ports:
   - "10259"
 k8s_firewall_worker_ports:
   - "10256"
-  - "30000:32767"
+  - "30000:32767"
+k8s_firewall_cilium_udp_ports:
+  - "8472"
+  - "4240"
+k8s_firewall_cilium_tcp_ports:
+  - "4240"

ansible/kubernetes/roles/k8s_node/tasks/firewall.yml

@@ -36,6 +36,24 @@
   loop: "{{ k8s_firewall_worker_ports }}"
   when: inventory_hostname in groups['worker']
 
+- name: Allow Cilium VXLAN and health check UDP ports from admin subnet
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: udp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_cilium_udp_ports }}"
+
+- name: Allow Cilium health check TCP ports from admin subnet
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_cilium_tcp_ports }}"
+
 - name: Enable ufw and deny incoming by default
   community.general.ufw:
     state: enabled