HCP Networking Requirements

This document outlines the networking port requirements for Hosted Control Plane (HCP) deployments. Understanding these requirements is essential for properly configuring firewalls, security groups, and network policies.

Overview

Hosted Control Planes require specific network ports to be open for communication between the management cluster, hosted control plane components, and worker nodes. The ports are categorized into ingress (incoming traffic to HCP) and egress (outgoing traffic from HCP) requirements.

Common Ingress Ports

The following port is required for incoming traffic to the Hosted Control Plane across all platforms:

Common Egress Ports

The following ports must be accessible for outgoing traffic from the Hosted Control Plane across all platforms:

Konnectivity Architecture

Konnectivity uses a reverse tunnel pattern for secure communication between the control plane and worker nodes. Worker nodes initiate outbound connections to the Konnectivity server (port 8091), establishing a tunnel. The control plane then uses these pre-established tunnels to reach back into the data plane without requiring direct network access to worker nodes. This design eliminates the need for worker nodes to have publicly accessible IPs while still allowing the control plane to manage them. For detailed Konnectivity architecture and troubleshooting, see Konnectivity in HyperShift.

Platform-Specific Port Configurations

Different platforms may use additional or alternative ports for specific services.

Private Clusters (AWS/Azure/GCP)

For private clusters using the private router:

Worker Node Egress Requirements

Worker nodes require outbound network access to the following HCP services:

Security Considerations

When configuring network access to the Hosted Control Plane, apply the following security principles:

Source IP Restrictions

• Restrict to Worker Subnets: When using NodePort/LoadBalancer publishing, ports 8091 (Konnectivity) and 8443 (Ignition Proxy) should be restricted to worker node subnet ranges only.
• Public Access Required: Port 6443/7443/2040 (Kubernetes API Server) may need broader access if external clients (kubectl, CI/CD) need to reach the cluster.
• Internal Only: Port 8080 (Agent CAPI metrics) binds to localhost (127.0.0.1) and is not externally accessible.

TLS Encryption

Most ports use TLS encryption with the following exceptions:

Unencrypted (HTTP) health check endpoints:

• Port 8081 (Agent/OpenStack CAPI Health) - HTTP health probes
• Port 9440 (CAPI Health on AWS/KubeVirt/PowerVS/OpenStack) - HTTP health probes

Other unencrypted ports:

• Port 53 (DNS) - standard unencrypted DNS protocol

Sensitive Data Warning

The Ignition Server (accessed via Route on port 443 or Ignition Proxy on port 8443) serves sensitive bootstrap data including: - Node certificates and keys - Kubeconfig files - Machine configuration

Ignition endpoints should be strictly limited to worker node subnets and blocked after initial bootstrap if possible.

Network Policy Considerations

When deploying Hosted Control Planes, consider the following network policy requirements:

1. Management Cluster to HCP: The hypershift-operator and control-plane-operator (running on the management cluster) need unrestricted network access to pods in the HCP namespace so they can reconcile control plane components (API server, etcd, Konnectivity, etc.).

2. HCP to Worker Nodes: The Konnectivity tunnel enables secure communication from the control plane to worker nodes without requiring direct network access.

3. Worker Nodes to HCP: Worker nodes need access to the Kubernetes API Server (port 6443 or platform-specific port) and Konnectivity Server (port 8091).

4. External Access: If exposing services externally, ensure the appropriate service publishing strategy (LoadBalancer, NodePort, or Route) is configured. See Exposing Services from HCP for more details.

Firewall Configuration Example

For a typical AWS deployment using Route service publishing, ensure the following security group rules:

Ingress Rules

Port 6443/TCP     - Kubernetes API Server (from worker nodes and external clients)
Port 443/TCP      - OpenShift Router for Ignition/Konnectivity Routes (from worker nodes)

Egress Rules

Port 443/TCP      - HTTPS (to container registries, Routes, external services)
Port 6443/TCP     - Management cluster API (to management cluster)
Port 53/TCP+UDP   - DNS (to DNS servers)

Related Documentation

• Exposing Services from HCP
• Service Publishing Strategies