NodePort restrictions?
See original GitHub issuePlease run microk8s.inspect
and attach the generated tarball to this issue.
We appreciate your feedback. Thank you for using microk8s. I want to expose my cluster in a single-node to external access and use nodePort for that purpose. However, it restricts port range to start from 30000. Is there any good reason for that? How can I change that to default HTTP and HTTPS ports? Thanks!
Issue Analytics
- State:
- Created 5 years ago
- Comments:12 (11 by maintainers)
Top Results From Across the Web
Think Before you NodePort in Kubernetes - Oteemo
By design, Kubernetes NodePort cannot expose standard low-numbered ports like 80 and 443, or even 8080 and 8443.
Read more >Disallow NodePort | Kyverno
A Kubernetes Service of type NodePort uses a host port to receive traffic from any source. A NetworkPolicy cannot be used to control...
Read more >Using a NodePort - Getting Traffic into a Cluster
Use NodePorts to expose the service nodePort on all nodes in the cluster. ... the nodes and local firewall rules on all nodes...
Read more >Service | Kubernetes
Restrict a Container's Access to Resources with AppArmor · Restrict a Container's Syscalls with seccomp · Stateless Applications.
Read more >Kubernetes NodePort and iptables rules - Ronak Nathani
In this post, I share some of what I have learned by digging a little deeper into the iptables rules for NodePort type...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
@khteh, you will need to add the
--service-node-port-range
argument to/var/snap/microk8s/current/args/kube-apiserver
and thensudo systemctl restart snap.microk8s.daemon-apiserver
.In respect to security, I am not sure how and to whom MicroK8s will be exposed, but you should be aware that MicroK8s does not take any action to protect its endpoints (eg port 8080). Some of those security concerns will be addressed in the upcoming releases as they are addressed by https://github.com/ubuntu/microk8s/pull/88 . Have a look at the PR as it describes what ports are left open .
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.