From 144e7a77b4a3b94f12d3d8e541bfaff284e8bc5c Mon Sep 17 00:00:00 2001 From: Adam Liddell Date: Sun, 10 Mar 2019 19:55:51 +0000 Subject: [PATCH] Update README for correct VXLAN port --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index fcdf28818a..a767f78dc1 100644 --- a/README.md +++ b/README.md @@ -163,14 +163,14 @@ Open ports / Network security --------------------------- The server needs port 6443 to be accessible by the nodes. The nodes need to be able to reach -other nodes over UDP port 4789. This is used for flannel VXLAN. If you don't use flannel -and provide your own custom CNI, then 4789 is not needed by k3s. The node should not listen +other nodes over UDP port 8472. This is used for flannel VXLAN. If you don't use flannel +and provide your own custom CNI, then 8472 is not needed by k3s. The node should not listen on any other port. k3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. IMPORTANT. The VXLAN port on nodes should not be exposed to the world, it opens up your cluster network to accessed by anyone. Run your nodes behind a firewall/security group that -disables access to port 4789. +disables access to port 8472. Server HA