Table of Contents

Search

  1. Preface
  2. Advanced clusters
  3. Setting up AWS
  4. Setting up Google Cloud
  5. Setting up Microsoft Azure
  6. Setting up a self-service cluster
  7. Setting up a local cluster
  8. Advanced configurations
  9. Troubleshooting
  10. Appendix A: Command reference

Advanced Clusters

Advanced Clusters

Create the worker security group

Create the worker security group

The worker security group defines the inbound and outbound rules between worker nodes in the
advanced cluster
and other nodes. This security group is attached to all worker nodes in the cluster.

Inbound rules

Inbound rules must allow the following traffic:
  • Incoming traffic from other worker nodes in the cluster. For example, communication between related Pods.
  • Incoming traffic from any master node in the cluster. For example, the master node contacts the kubelet on worker nodes to get logs or support port forwarding.
  • Incoming traffic using HTTPS with TCP at port 443 from the ELB security group in the same cluster.
  • Incoming SSH access from outside the cluster. This rule is the same as the SSH inbound rule defined for the master security group and is needed only if you want to access the worker node using SSH.
The following image shows the required inbound rules:
The worker security group shows four inbound rules. The first inbound rule is All traffic with protocol (All), port range (All), and the source is the master security group ID (sg-0b4f93297a739d4b3). The second inbound rule is SSH with IP version (IPv4), protocol (TCP), port range (22), and the source is the IP address of the Secure Agent machine. The third inbound rule is HTTPS with protocol (TCP), port range (443), and the source is the ELB security group ID (sg-033b65c92bf0bc892). The fourth inbound rule is All traffic with protocol (All), port range (All), and the source is the worker security group ID (sg-06a5d3ae543a983a).

Outbound rules

Use the default outbound rule to allow all outbound traffic.
Outbound traffic from worker nodes can include the ELB security group; master nodes; other worker nodes; the Secure Agent; other managed services on AWS such as Amazon S3, EC2, and IAM; other storage services; and other public services. Additionally, the outbound rules must allow
advanced jobs
to communicate with data sources, such as Redshift and Snowflake databases, and external services, such as REST endpoints that the Secure Agent exposes.

0 COMMENTS

We’d like to hear from you!