Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ufw to k3s known issues #2732

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add ufw to k3s known issues #2732

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions content/k3s/latest/en/known-issues/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,12 @@ If you are running iptables in nftables mode instead of legacy you might encount
**RootlessKit**

Running K3s with RootlessKit is experimental and has several [known issues.]({{<baseurl>}}/k3s/latest/en/advanced/#known-issues-with-rootlesskit)

**Ufw**

UFW firewall rules are evaluated prior to the kube-proxy rules, so traffic to cluster services can be blocked. Traffic from the service and pod networks should be allowed in ufw to ensure that the kube-proxy rules are evaluated. Given the default values, the following will allow traffic from those network through the ufw portion, before reaching the kube-proxy rules.

```
sudo ufw allow from 10.42.0.0/16 to any
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd be curious to see the actual resulting chain on the iptables side after applying these UFW rules. I'm not sure we should be blindly adding these instructions to our docs without a full understanding of what is going on (and assurance that we aren't going to still have other "good" traffic blocked)

I think this needs more investigation IMO

sudo ufw allow from 10.43.0.0/16 to any
```