From 27dddc6e828f806b13a634525c4e632a01b88a22 Mon Sep 17 00:00:00 2001
From: Kay Yan <kay.yan@daocloud.io>
Date: Tue, 11 Apr 2023 03:23:32 +0000
Subject: [PATCH] wqAdd-Port-Requirements

---
 docs/port-requirements.md | 70 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 docs/port-requirements.md

diff --git a/docs/port-requirements.md b/docs/port-requirements.md
new file mode 100644
index 00000000000..1bd56979378
--- /dev/null
+++ b/docs/port-requirements.md
@@ -0,0 +1,70 @@
+# Port Requirements
+
+To operate properly, KubeSpray requires some ports to be opened. If the network is configured with firewall rules, it is needed to ensure infrastructure components can communicate with each other through specific ports.
+
+Ensure the following ports required by KubeSpray are open on the network and configured to allow access between hosts. Some ports are optional depending on the configuration and usage.
+
+## Kubernetes
+
+### Control plane
+
+| Protocol | Port   | Description     |
+|----------|--------| ------------    |
+| TCP      | 22     | ssh for ansible |
+| TCP      | 2379   | etcd client port|
+| TCP      | 2380   | etcd peer port  |
+| TCP      | 6443   | kubernetes api  |
+| TCP      | 10250  | kubelet api     |
+| TCP      | 10257  | kube-scheduler  |
+| TCP      | 10259  | kube-controller-manager  |
+
+### Worker node(s)
+
+| Protocol | Port       | Description     |
+|----------|--------    | ------------    |
+| TCP      | 22         | ssh for ansible |
+| TCP      | 10250      | kubelet api     |
+| TCP      | 30000-32767| kube nodePort range |
+
+refers to: [Kubernetes Docs](https://kubernetes.io/docs/reference/networking/ports-and-protocols/)
+
+## Calico
+
+If Calico is be used, it requires:
+
+| Protocol | Port       | Description   |
+|----------|--------    | ------------  |
+| TCP      | 179        | Calico networking (BGP) |
+| UDP      | 4789       | Calico CNI with VXLAN enabled |
+| TCP      | 5473       | Calico CNI with Typha enabled  |
+| UDP      | 51820      | Calico with IPv4 Wireguard enabled |
+| UDP      | 51821      | Calico with IPv6 Wireguard enabled |
+| IPENCAP / IPIP | -    | Calico CNI with IPIP enabled  |
+
+refers to: [Calico Docs](https://docs.tigera.io/calico/latest/getting-started/kubernetes/requirements#network-requirements)
+
+## Cilium
+
+If Cilium  is be used, it requires:
+
+| Protocol | Port     | Description   |
+|----------|--------  | ------------  |
+| TCP      | 4240     | Cilium Health checks (``cilium-health``)  |
+| TCP      | 4244     | Hubble server  |
+| TCP      | 4245     | Hubble Relay  |
+| UDP      | 8472     | VXLAN overlay  |
+| TCP      | 9962     | Cilium-agent Prometheus metrics  |
+| TCP      | 9963     | Cilium-operator Prometheus metrics  |
+| TCP      | 9964     | Cilium-proxy Prometheus metrics  |
+| UDP      | 51871    | WireGuard encryption tunnel endpoint  |
+| ICMP     | -        | health checks  |
+
+refers to: [Cilium Docs](https://docs.cilium.io/en/v1.13/operations/system_requirements/)
+
+## Addons
+
+| Protocol | Port       | Description   |
+|----------|--------    | ------------  |
+| TCP      | 9100       | node exporter |
+| TCP/UDP  | 7472       | metallb metrics ports |
+| TCP/UDP  | 7946       | metallb L2 operating mode |