What are the recommendations for AKS Network Port Configuration?
Issue Description :
AKS Network Port Configuration – Clarification and Recommendations
Resolution :
The multiple custom ports you've observed are necessary for the proper functioning of Automation Suite components within the AKS environment. These ports facilitate internal communication between various services and are part of the standard configuration.
Key Ports and Their Purposes:
- Port 443 (TCP): For HTTPS access to Automation Suite
- Port 6443 (TCP): For accessing the Kubernetes API server
- Port 8472 (UDP): Required for Cilium (network policy enforcement)
- Port 9090 (TCP): Used by Cilium for monitoring
- Port 9345 (TCP): For Kubernetes API server access and node joining
- Port 10250 (TCP): For kubelet and metrics server communication
- Port 30071 (TCP): NodePort for internal cluster communication
- 8080, 6040, and 5000, are associated with various services within the UiPath namespace. Generally, these ports must remain open if they are required for inter-service communication or if they expose the necessary services to external clients.
From the documentation on AKS networking, it is highlighted that while network security groups manage traffic for VMs, network policies within Kubernetes provide a more granular way to control traffic at the pod level. Thus, if the services are designed to communicate over these ports, restricting them may lead to malfunction or connectivity issues.
- The provided ports (e.g., 8080, 6040, 5000) are vital for specific UiPath services.
- They should remain open to ensure that inter-service communication functions correctly.
- For security measures, consider implementing network policies that limit unnecessary traffic and specify which services can communicate with each other, rather than completely restricting these ports.