Skip to content

Commit 1955b23

Browse files
dghubbledghubble
committed
Change flannel port from 4789 to 8472
* flannel and Cilium default to UDP 8472 for VXLAN traffic to avoid conflicts with other VXLAN usage (e.g. Open vSwith) * Aligning flannel and Cilium to use the same vxlan port makes firewall rules or security policies simpler across clouds Rel: poseidon/terraform-render-bootstrap#403
1 parent ec1d9bc commit 1955b23

File tree

20 files changed

+31
-223
lines changed

20 files changed

+31
-223
lines changed

‎CHANGES.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ Notable changes between versions.
99
* Kubernetes [v1.32.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.32.md#v1320)
1010
* Change the default Pod CIDR from 10.2.0.0/16 to 10.20.0.0/14 ([#1555](https://github.com/poseidon/typhoon/pull/1555))
1111
* Configure Kubelets for parallel image pulls ([#1556](https://github.com/poseidon/typhoon/pull/1556))
12+
* Change flannel port from 4789 to 8472 to match Cilium ([#1561](https://github.com/poseidon/typhoon/pull/1561))
13+
* Reverses a choice made in [#466](https://github.com/poseidon/typhoon/pull/466)
1214
* Remove support for Calico CNI (choose between `networking` cilium or flannel) ([#1558](https://github.com/poseidon/typhoon/pull/1558))
1315
* Remove Calico firewall rules or security group rules
1416
* Remove `network_mtu`, `network_encapsulation`, and `network_ip_autodetection_method` variables (Calico-specific)

‎addons/flannel/config.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ resource "kubernetes_config_map" "config" {
3535
"Network": "${var.pod_cidr}",
3636
"Backend": {
3737
"Type": "vxlan",
38-
"Port": 4789
38+
"Port": 8472
3939
}
4040
}
4141
EOF

‎aws/fedora-coreos/kubernetes/bootstrap.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Kubernetes assets (kubeconfig, manifests)
22
module "bootstrap" {
3-
source = "git::https://github.com/poseidon/terraform-render-bootstrap.git?ref=33f8d2083cd2da5a18f954dd4f765b482d9b8046"
3+
source = "git::https://github.com/poseidon/terraform-render-bootstrap.git?ref=3edb0ae646faaf79406e1bb5cc94038edab32f21"
44

55
cluster_name = var.cluster_name
66
api_servers = [format("%s.%s", var.cluster_name, var.dns_zone)]

‎aws/fedora-coreos/kubernetes/security.tf‎

Lines changed: 4 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -116,31 +116,6 @@ resource "aws_security_group_rule" "controller-cilium-metrics-self" {
116116
self = true
117117
}
118118

119-
# IANA VXLAN default
120-
resource "aws_security_group_rule" "controller-vxlan" {
121-
count = var.networking == "flannel" ? 1 : 0
122-
123-
security_group_id = aws_security_group.controller.id
124-
125-
type = "ingress"
126-
protocol = "udp"
127-
from_port = 4789
128-
to_port = 4789
129-
source_security_group_id = aws_security_group.worker.id
130-
}
131-
132-
resource "aws_security_group_rule" "controller-vxlan-self" {
133-
count = var.networking == "flannel" ? 1 : 0
134-
135-
security_group_id = aws_security_group.controller.id
136-
137-
type = "ingress"
138-
protocol = "udp"
139-
from_port = 4789
140-
to_port = 4789
141-
self = true
142-
}
143-
144119
resource "aws_security_group_rule" "controller-apiserver" {
145120
security_group_id = aws_security_group.controller.id
146121

@@ -152,9 +127,7 @@ resource "aws_security_group_rule" "controller-apiserver" {
152127
}
153128

154129
# Linux VXLAN default
155-
resource "aws_security_group_rule" "controller-linux-vxlan" {
156-
count = var.networking == "cilium" ? 1 : 0
157-
130+
resource "aws_security_group_rule" "controller-vxlan" {
158131
security_group_id = aws_security_group.controller.id
159132

160133
type = "ingress"
@@ -164,9 +137,7 @@ resource "aws_security_group_rule" "controller-linux-vxlan" {
164137
source_security_group_id = aws_security_group.worker.id
165138
}
166139

167-
resource "aws_security_group_rule" "controller-linux-vxlan-self" {
168-
count = var.networking == "cilium" ? 1 : 0
169-
140+
resource "aws_security_group_rule" "controller-vxlan-self" {
170141
security_group_id = aws_security_group.controller.id
171142

172143
type = "ingress"
@@ -367,35 +338,8 @@ resource "aws_security_group_rule" "worker-cilium-metrics-self" {
367338
self = true
368339
}
369340

370-
# IANA VXLAN default
371-
resource "aws_security_group_rule" "worker-vxlan" {
372-
count = var.networking == "flannel" ? 1 : 0
373-
374-
security_group_id = aws_security_group.worker.id
375-
376-
type = "ingress"
377-
protocol = "udp"
378-
from_port = 4789
379-
to_port = 4789
380-
source_security_group_id = aws_security_group.controller.id
381-
}
382-
383-
resource "aws_security_group_rule" "worker-vxlan-self" {
384-
count = var.networking == "flannel" ? 1 : 0
385-
386-
security_group_id = aws_security_group.worker.id
387-
388-
type = "ingress"
389-
protocol = "udp"
390-
from_port = 4789
391-
to_port = 4789
392-
self = true
393-
}
394-
395341
# Linux VXLAN default
396-
resource "aws_security_group_rule" "worker-linux-vxlan" {
397-
count = var.networking == "cilium" ? 1 : 0
398-
342+
resource "aws_security_group_rule" "worker-vxlan" {
399343
security_group_id = aws_security_group.worker.id
400344

401345
type = "ingress"
@@ -405,9 +349,7 @@ resource "aws_security_group_rule" "worker-linux-vxlan" {
405349
source_security_group_id = aws_security_group.controller.id
406350
}
407351

408-
resource "aws_security_group_rule" "worker-linux-vxlan-self" {
409-
count = var.networking == "cilium" ? 1 : 0
410-
352+
resource "aws_security_group_rule" "worker-vxlan-self" {
411353
security_group_id = aws_security_group.worker.id
412354

413355
type = "ingress"

‎aws/flatcar-linux/kubernetes/bootstrap.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Kubernetes assets (kubeconfig, manifests)
22
module "bootstrap" {
3-
source = "git::https://github.com/poseidon/terraform-render-bootstrap.git?ref=33f8d2083cd2da5a18f954dd4f765b482d9b8046"
3+
source = "git::https://github.com/poseidon/terraform-render-bootstrap.git?ref=3edb0ae646faaf79406e1bb5cc94038edab32f21"
44

55
cluster_name = var.cluster_name
66
api_servers = [format("%s.%s", var.cluster_name, var.dns_zone)]

‎aws/flatcar-linux/kubernetes/security.tf‎

Lines changed: 4 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -116,31 +116,6 @@ resource "aws_security_group_rule" "controller-cilium-metrics-self" {
116116
self = true
117117
}
118118

119-
# IANA VXLAN default
120-
resource "aws_security_group_rule" "controller-vxlan" {
121-
count = var.networking == "flannel" ? 1 : 0
122-
123-
security_group_id = aws_security_group.controller.id
124-
125-
type = "ingress"
126-
protocol = "udp"
127-
from_port = 4789
128-
to_port = 4789
129-
source_security_group_id = aws_security_group.worker.id
130-
}
131-
132-
resource "aws_security_group_rule" "controller-vxlan-self" {
133-
count = var.networking == "flannel" ? 1 : 0
134-
135-
security_group_id = aws_security_group.controller.id
136-
137-
type = "ingress"
138-
protocol = "udp"
139-
from_port = 4789
140-
to_port = 4789
141-
self = true
142-
}
143-
144119
resource "aws_security_group_rule" "controller-apiserver" {
145120
security_group_id = aws_security_group.controller.id
146121

@@ -152,9 +127,7 @@ resource "aws_security_group_rule" "controller-apiserver" {
152127
}
153128

154129
# Linux VXLAN default
155-
resource "aws_security_group_rule" "controller-linux-vxlan" {
156-
count = var.networking == "cilium" ? 1 : 0
157-
130+
resource "aws_security_group_rule" "controller-vxlan" {
158131
security_group_id = aws_security_group.controller.id
159132

160133
type = "ingress"
@@ -164,9 +137,7 @@ resource "aws_security_group_rule" "controller-linux-vxlan" {
164137
source_security_group_id = aws_security_group.worker.id
165138
}
166139

167-
resource "aws_security_group_rule" "controller-linux-vxlan-self" {
168-
count = var.networking == "cilium" ? 1 : 0
169-
140+
resource "aws_security_group_rule" "controller-vxlan-self" {
170141
security_group_id = aws_security_group.controller.id
171142

172143
type = "ingress"
@@ -367,35 +338,8 @@ resource "aws_security_group_rule" "worker-cilium-metrics-self" {
367338
self = true
368339
}
369340

370-
# IANA VXLAN default
371-
resource "aws_security_group_rule" "worker-vxlan" {
372-
count = var.networking == "flannel" ? 1 : 0
373-
374-
security_group_id = aws_security_group.worker.id
375-
376-
type = "ingress"
377-
protocol = "udp"
378-
from_port = 4789
379-
to_port = 4789
380-
source_security_group_id = aws_security_group.controller.id
381-
}
382-
383-
resource "aws_security_group_rule" "worker-vxlan-self" {
384-
count = var.networking == "flannel" ? 1 : 0
385-
386-
security_group_id = aws_security_group.worker.id
387-
388-
type = "ingress"
389-
protocol = "udp"
390-
from_port = 4789
391-
to_port = 4789
392-
self = true
393-
}
394-
395341
# Linux VXLAN default
396-
resource "aws_security_group_rule" "worker-linux-vxlan" {
397-
count = var.networking == "cilium" ? 1 : 0
398-
342+
resource "aws_security_group_rule" "worker-vxlan" {
399343
security_group_id = aws_security_group.worker.id
400344

401345
type = "ingress"
@@ -405,9 +349,7 @@ resource "aws_security_group_rule" "worker-linux-vxlan" {
405349
source_security_group_id = aws_security_group.controller.id
406350
}
407351

408-
resource "aws_security_group_rule" "worker-linux-vxlan-self" {
409-
count = var.networking == "cilium" ? 1 : 0
410-
352+
resource "aws_security_group_rule" "worker-vxlan-self" {
411353
security_group_id = aws_security_group.worker.id
412354

413355
type = "ingress"

‎azure/fedora-coreos/kubernetes/bootstrap.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Kubernetes assets (kubeconfig, manifests)
22
module "bootstrap" {
3-
source = "git::https://github.com/poseidon/terraform-render-bootstrap.git?ref=33f8d2083cd2da5a18f954dd4f765b482d9b8046"
3+
source = "git::https://github.com/poseidon/terraform-render-bootstrap.git?ref=3edb0ae646faaf79406e1bb5cc94038edab32f21"
44

55
cluster_name = var.cluster_name
66
api_servers = [format("%s.%s", var.cluster_name, var.dns_zone)]

‎azure/fedora-coreos/kubernetes/security.tf‎

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -164,22 +164,6 @@ resource "azurerm_network_security_rule" "controller-vxlan" {
164164
direction = "Inbound"
165165
protocol = "Udp"
166166
source_port_range = "*"
167-
destination_port_range = "4789"
168-
source_address_prefixes = local.cluster_subnets[each.key]
169-
destination_address_prefixes = local.controller_subnets[each.key]
170-
}
171-
172-
resource "azurerm_network_security_rule" "controller-linux-vxlan" {
173-
for_each = local.controller_subnets
174-
175-
name = "allow-linux-vxlan-${each.key}"
176-
resource_group_name = azurerm_resource_group.cluster.name
177-
network_security_group_name = azurerm_network_security_group.controller.name
178-
priority = 2022 + (each.key == "ipv4" ? 0 : 1)
179-
access = "Allow"
180-
direction = "Inbound"
181-
protocol = "Udp"
182-
source_port_range = "*"
183167
destination_port_range = "8472"
184168
source_address_prefixes = local.cluster_subnets[each.key]
185169
destination_address_prefixes = local.controller_subnets[each.key]
@@ -368,22 +352,6 @@ resource "azurerm_network_security_rule" "worker-vxlan" {
368352
direction = "Inbound"
369353
protocol = "Udp"
370354
source_port_range = "*"
371-
destination_port_range = "4789"
372-
source_address_prefixes = local.cluster_subnets[each.key]
373-
destination_address_prefixes = local.worker_subnets[each.key]
374-
}
375-
376-
resource "azurerm_network_security_rule" "worker-linux-vxlan" {
377-
for_each = local.worker_subnets
378-
379-
name = "allow-linux-vxlan-${each.key}"
380-
resource_group_name = azurerm_resource_group.cluster.name
381-
network_security_group_name = azurerm_network_security_group.worker.name
382-
priority = 2018 + (each.key == "ipv4" ? 0 : 1)
383-
access = "Allow"
384-
direction = "Inbound"
385-
protocol = "Udp"
386-
source_port_range = "*"
387355
destination_port_range = "8472"
388356
source_address_prefixes = local.cluster_subnets[each.key]
389357
destination_address_prefixes = local.worker_subnets[each.key]

‎azure/flatcar-linux/kubernetes/bootstrap.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Kubernetes assets (kubeconfig, manifests)
22
module "bootstrap" {
3-
source = "git::https://github.com/poseidon/terraform-render-bootstrap.git?ref=33f8d2083cd2da5a18f954dd4f765b482d9b8046"
3+
source = "git::https://github.com/poseidon/terraform-render-bootstrap.git?ref=3edb0ae646faaf79406e1bb5cc94038edab32f21"
44

55
cluster_name = var.cluster_name
66
api_servers = [format("%s.%s", var.cluster_name, var.dns_zone)]

‎azure/flatcar-linux/kubernetes/security.tf‎

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -164,22 +164,6 @@ resource "azurerm_network_security_rule" "controller-vxlan" {
164164
direction = "Inbound"
165165
protocol = "Udp"
166166
source_port_range = "*"
167-
destination_port_range = "4789"
168-
source_address_prefixes = local.cluster_subnets[each.key]
169-
destination_address_prefixes = local.controller_subnets[each.key]
170-
}
171-
172-
resource "azurerm_network_security_rule" "controller-linux-vxlan" {
173-
for_each = local.controller_subnets
174-
175-
name = "allow-linux-vxlan-${each.key}"
176-
resource_group_name = azurerm_resource_group.cluster.name
177-
network_security_group_name = azurerm_network_security_group.controller.name
178-
priority = 2022 + (each.key == "ipv4" ? 0 : 1)
179-
access = "Allow"
180-
direction = "Inbound"
181-
protocol = "Udp"
182-
source_port_range = "*"
183167
destination_port_range = "8472"
184168
source_address_prefixes = local.cluster_subnets[each.key]
185169
destination_address_prefixes = local.controller_subnets[each.key]
@@ -368,22 +352,6 @@ resource "azurerm_network_security_rule" "worker-vxlan" {
368352
direction = "Inbound"
369353
protocol = "Udp"
370354
source_port_range = "*"
371-
destination_port_range = "4789"
372-
source_address_prefixes = local.cluster_subnets[each.key]
373-
destination_address_prefixes = local.worker_subnets[each.key]
374-
}
375-
376-
resource "azurerm_network_security_rule" "worker-linux-vxlan" {
377-
for_each = local.worker_subnets
378-
379-
name = "allow-linux-vxlan-${each.key}"
380-
resource_group_name = azurerm_resource_group.cluster.name
381-
network_security_group_name = azurerm_network_security_group.worker.name
382-
priority = 2018 + (each.key == "ipv4" ? 0 : 1)
383-
access = "Allow"
384-
direction = "Inbound"
385-
protocol = "Udp"
386-
source_port_range = "*"
387355
destination_port_range = "8472"
388356
source_address_prefixes = local.cluster_subnets[each.key]
389357
destination_address_prefixes = local.worker_subnets[each.key]

0 commit comments

Comments
 (0)