Microk8s Firewalld Service

microk8s-firewalld-service.md

MicroK8s firewalld service

Create a firewalld service file

foo@bar:~$ sudo vi /etc/firewalld/services/microk8s.xml

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>MicroK8s Service</short>
  <description>MicroK8s ports</description>
  <port protocol="tcp" port="16443"/>
  <port protocol="tcp" port="10250"/>
  <port protocol="tcp" port="10255"/>
  <port protocol="tcp" port="25000"/>
  <port protocol="tcp" port="12379"/>
  <port protocol="tcp" port="10257"/>
  <port protocol="tcp" port="10259"/>
  <port protocol="tcp" port="19001"/>
</service>

Reload firewalld and locate the new service

foo@bar:~$ sudo firewall-cmd --reload
foo@bar:~$ firewall-cmd --get-services | grep 'microk8s'

Enable Service

foo@bar:~$ sudo firewall-cmd --zone=public --permanent --add-service=microk8s

---

Manualy remove old open ports

foo@bar:~$ sudo firewall-cmd --zone=public --permanent --remove-port=6443/tcp &&
 sudo firewall-cmd --zone=public --permanent --remove-port=10250/tcp &&
 sudo firewall-cmd --zone=public --permanent --remove-port=10255/tcp &&
 sudo firewall-cmd --zone=public --permanent --remove-port=25000/tcp &&
 sudo firewall-cmd --zone=public --permanent --remove-port=12379/tcp &&
 sudo firewall-cmd --zone=public --permanent --remove-port=10257/tcp &&
 sudo firewall-cmd --zone=public --permanent --remove-port=10259/tcp &&
 sudo firewall-cmd --zone=public --permanent --remove-port=19001/tcp

calico is missing
https://microk8s.io/docs/services-and-ports
4789/udp calico Calico networking with VXLAN enabled.

so

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>MicroK8s Service</short>
  <description>MicroK8s ports</description>
  <port protocol="tcp" port="16443"/>
  <port protocol="tcp" port="10250"/>
  <port protocol="tcp" port="10255"/>
  <port protocol="tcp" port="25000"/>
  <port protocol="tcp" port="12379"/>
  <port protocol="tcp" port="10257"/>
  <port protocol="tcp" port="10259"/>
  <port protocol="tcp" port="19001"/>
  <port protocol="udp" port="4789" />
</service>