The ELB security group defines the inbound rules between the Kubernetes API server and clients that are external to the
advanced cluster
. It also defines the outbound rules between the Kubernetes API server and cluster nodes. This security group is attached to the load balancer that the agent provisions for the
advanced cluster
.
Inbound rules
The inbound rules identify the nodes outside of the
advanced cluster
that can access the Kubernetes API server using HTTPS.
The inbound rules must allow the following traffic:
Incoming traffic from the Secure Agent that creates the
advanced cluster
.
Incoming traffic from master nodes in the same cluster.
Incoming traffic from worker nodes in the same cluster.
Incoming traffic from the Secure Agent using TCP port 31447. The Secure Agent uses this port to run data preview jobs. If you need to change this port number, contact Informatica Global Customer Support.
For
advanced clusters
that use a CLAIRE-powered configuration, include traffic from the Secure Agent to the Prometheus server using TCP port 30000.
The following image shows the required inbound rules:
Outbound rules
Use the default outbound rule to allow all outbound traffic.
You can restrict the destination of this rule, but the destination must include HTTPS traffic to all master nodes in the cluster.