Inbound rules must allow the following traffic:

Incoming traffic from other worker nodes in the cluster. For example, communication between related Pods.
Incoming traffic from any master node in the cluster. For example, the master node contacts the kubelet on worker nodes to get logs or support port forwarding.
Incoming traffic from TCP ports 10250, 10257, and 10259.
Incoming traffic using HTTPS with TCP at port 443 from the ELB security group in the same cluster.
Incoming SSH access from outside the cluster. This rule is the same as the SSH inbound rule defined for the master security group and is needed only if you want to access the worker node using SSH.

The following image shows the required inbound rules:

Use the default outbound rule to allow all outbound traffic.

Outbound traffic from worker nodes can include the ELB security group; master nodes; other worker nodes; the Secure Agent; other managed services on AWS such as Amazon S3, EC2, and IAM; other storage services; and other public services. Additionally, the outbound rules must allow

advanced jobs

to communicate with data sources, such as Redshift and Snowflake databases, and external services, such as REST endpoints that the Secure Agent exposes.