The master security group defines the inbound rules between the master nodes and the worker nodes in the
advanced cluster
, the ELB security group, and the Secure Agent. It also defines outbound rules to other nodes. This security group is attached to all master nodes in the cluster.
Inbound rules
Inbound rules must allow the following traffic:
Incoming traffic from worker nodes in the same cluster. For example, worker nodes accessing the API server through the service named "kubernetes," or kube-proxy forwarding the network traffic inside or outside the cluster. You can simplify the inbound rules for worker nodes by configuring the rule for custom TCP and UDP with port range 1024 - 65535, as well as HTTPs with TCP at port 443.
Incoming traffic from other master nodes in the same cluster.
Incoming traffic using HTTPS over TCP at port 443 from the ELB security group in the same cluster.
Incoming traffic using SSH over port 22.
Incoming traffic using TCP port 31447, which is from the ELB security group in the same cluster. The Secure Agent uses this port to run data preview jobs.
For
advanced clusters
that use a CLAIRE-powered configuration, include traffic from the Secure Agent to the Prometheus server using TCP port 30000.
When you create and use a user-defined master security group, the Secure Agent ignores the following default rules for SSH access from outside the cluster:
The IP address of the Secure Agent, from where the cluster is created, can use the SSH protocol to connect to worker nodes through port 22.
The ability to configure the source Classless Inter-Domain Routing (CIDR) address using a custom property.
The configuration of SSH port using a custom property.
The ability to set a local file path on an agent node for a public key using a custom property.
The following image shows the required inbound rules:
Outbound rules
Use the default outbound rule to allow all outbound traffic.
Outbound traffic from the master node can include the other master nodes; the ELB security group; worker nodes; Secure Agents; other managed services on AWS such Amazon S3, EC2, and IAM; other storage services; and other public services.