This topic describes the firewall ports and protocols requirements for using VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) on vSphere with NSX integration.

If you are not using TKGI on vSphere with NSX, see one of the follow topics instead:



Overview

Apps frequently require the ability to pass internal communication between system components on different networks.

Firewalls and Kubernetes Pod Security Admission are used to filter traffic and limit access in environments with strict inter-network access control policies and your apps require one or more conduits through a secured environment’s firewalls.

VMware recommends that rather than using a Kubernetes Pod Security Admission to filter traffic between networks and TKGI system components and clusters that you instead use one of the following methods:

  • Enable access to apps through standard Kubernetes load-balancers and ingress controller types. This enables you to designate specific ports and protocols as a firewall conduit.
  • Enable access using the NSX load balancer and ingress. This enables you to configure external addresses and ports that are automatically mapped and resolved to internal/local addresses and ports.

For more information about vSphere with NSX port and protocol requirements, see VMware Ports and Protocols on the VMware site.

Consult the following tables when configuring port settings to install or upgrade TKGI or configure a Kubernetes cluster:

Note: To control which groups access deploying and scaling your organization’s Tanzu Kubernetes Grid Integrated Edition-deployed Kubernetes clusters, configure your firewall settings as described on the Operator –> TKGI API server lines below.



TKGI Ports and Protocols

The following tables list ports and protocols required for network communications between Tanzu Kubernetes Grid Integrated Edition v1.5.0 and later, and vSphere 6.7 and NSX-T or NSX 2.4.0.1 and later.


TKGI Users Ports and Protocols

The following table lists ports and protocols used for network communication between TKGI user interface components.

Source Component Destination Component Destination Protocol Destination Port Service
Admin/Operator Console All System Components TCP 22 SSH
Admin/Operator Console All System Components TCP 80 HTTP
Admin/Operator Console All System Components TCP 443 HTTPS
Admin/Operator Console BOSH Director TCP 25555 BOSH Director REST API
Admin/Operator Console NSX API VIP TCP 443 HTTPS
Admin/Operator Console Ops Manager TCP 22 SSH
Admin/Operator Console Ops Manager TCP 443 HTTPS
Admin/Operator Console TKGI Controller TCP 9021 TKGI API Server
Admin/Operator Console vCenter Server TCP 443 HTTPS
Admin/Operator Console vCenter Server TCP 5480 vami
Admin/Operator Console vSphere ESXI Hosts Mgmt. vmknic TCP 902 ideafarm-door
Admin/Operator and Developer Consoles Harbor Private Image Registry TCP 80 HTTP
Admin/Operator and Developer Consoles Harbor Private Image Registry TCP 443 HTTPS
Admin/Operator and Developer Consoles Harbor Private Image Registry TCP 4443 notary
Admin/Operator and Developer Consoles Kubernetes App Load-Balancer Svc TCP/UDP Varies varies with apps
Admin/Operator and Developer Consoles Kubernetes Cluster API Server -LB VIP TCP 8443 HTTPSCA
Admin/Operator and Developer Consoles Kubernetes Cluster Ingress Controller TCP 80 HTTP
Admin/Operator and Developer Consoles Kubernetes Cluster Ingress Controller TCP 443 HTTPS
Admin/Operator and Developer Consoles Kubernetes Cluster Worker Node TCP/UDP 30000-32767 Kubernetes NodePort
Admin/Operator and Developer Consoles TKGI Controller TCP 8443 HTTPSCA
All User Consoles (Operator, Developer, Consumer) Kubernetes App Load-Balancer Svc TCP/UDP Varies varies with apps
All User Consoles (Operator, Developer, Consumer) Kubernetes Cluster Ingress Controller TCP 80 HTTP
All User Consoles (Operator, Developer, Consumer) Kubernetes Cluster Ingress Controller TCP 443 HTTPS
All User Consoles (Operator, Developer, Consumer) Kubernetes Cluster Worker Node TCP/UDP 30000-32767 Kubernetes NodePort

Note: The type:NodePort Service type is not supported for TKGI deployments on vSphere with NSX. Only type:LoadBalancer and Services associated with Ingress rules are supported on vSphere with NSX.


TKGI Core Ports and Protocols

The following table lists ports and protocols used for network communication between core TKGI components.

Source Component Destination Component Destination Protocol Destination Port Service
All System Components Corporate Domain Name Server TCP/UDP 53 DNS
All System Components Network Time Server UDP 123 NTP
All System Components vRealize LogInsight TCP/UDP 514/1514 syslog/tls syslog
All System Control Plane Components AD/LDAP Directory Server TCP/UDP 389/636 LDAP/LDAPS
Ops Manager Admin/Operator Console TCP 22 SSH
Ops Manager BOSH Director TCP 6868 BOSH Agent HTTP
Ops Manager BOSH Director TCP 8443 HTTPSCA
Ops Manager BOSH Director TCP 8844 BOSH CredHub
Ops Manager BOSH Director TCP 25555 BOSH Director REST API
Ops Manager Harbor Private Image Registry TCP 22 SSH
Ops Manager Kubernetes Cluster Control Plane/etcd Node TCP 22 SSH
Ops Manager Kubernetes Cluster Worker Node TCP 22 SSH
Ops Manager NSX API VIP TCP 443 HTTPS
Ops Manager NSX Manager/Controller Node TCP 22 SSH
Ops Manager NSX Manager/Controller Node TCP 443 HTTPS
Ops Manager TKGI Controller TCP 22 SSH
Ops Manager TKGI Controller TCP 8443 HTTPSCA
Ops Manager vCenter Server TCP 443 HTTPS
Ops Manager vSphere ESXI Hosts Mgmt. vmknic TCP 443 HTTPS
BOSH Director NSX API VIP TCP 443 HTTPS
BOSH Director vCenter Server TCP 443 HTTPS
BOSH Director vSphere ESXI Hosts Mgmt. vmknic TCP 443 HTTPS
BOSH Compilation Job VM BOSH Director TCP 4222 BOSH nats server
BOSH Compilation Job VM BOSH Director TCP 25250 BOSH BlobStore
BOSH Compilation Job VM BOSH Director TCP 25923 health monitor daemon
BOSH Compilation Job VM Harbor Private Image Registry TCP 443 HTTPS
BOSH Compilation Job VM Harbor Private Image Registry TCP 8853 BOSH DNS health
TKGI Controller BOSH Director TCP 4222 BOSH nats server
TKGI Controller BOSH Director TCP 8443 HTTPSCA
TKGI Controller BOSH Director TCP 25250 BOSH BlobStore
TKGI Controller BOSH Director TCP 25555 BOSH director rest api
TKGI Controller BOSH Director TCP 25923 health monitor daemon
TKGI Controller Kubernetes Cluster Control Plane/etcd Node TCP 8443 HTTPSCA
TKGI Controller TKGI Database VM TCP 3306 tkgi db proxy
TKGI Controller NSX API VIP TCP 443 HTTPS
TKGI Controller vCenter Server TCP 443 HTTPS
Harbor Private Image Registry BOSH Director TCP 4222 BOSH nats server
Harbor Private Image Registry BOSH Director TCP 25250 BOSH BlobStore
Harbor Private Image Registry BOSH Director TCP 25923 health monitor daemon
Harbor Private Image Registry IP NAS Storage Array TCP 111 NFS RPC portmapper
Harbor Private Image Registry IP NAS Storage Array TCP 2049 NFS
Harbor Private Image Registry Public CVE Source Database TCP 443 HTTPS
kube-system pod/telemetry-agent TKGI Controller TCP 24224 Fluentd out_forward
Kubernetes Cluster Ingress Controller NSX API VIP TCP 443 HTTPS
Kubernetes Cluster Control Plane/etcd Node BOSH Director TCP 4222 BOSH NATS Server
Kubernetes Cluster Control Plane/etcd Node BOSH Director TCP 25250 BOSH BlobStore
Kubernetes Cluster Control Plane/etcd Node BOSH Director TCP 25923 health monitor daemon
Kubernetes Cluster Control Plane/etcd Node Kubernetes Cluster Control Plane/etcd Node TCP 2379 etcd client
Kubernetes Cluster Control Plane/etcd Node Kubernetes Cluster Control Plane/etcd Node TCP 2380 etcd server
Kubernetes Cluster Control Plane/etcd Node Kubernetes Cluster Control Plane/etcd Node TCP 8443 HTTPSCA
Kubernetes Cluster Control Plane/etcd Node Kubernetes Cluster Control Plane/etcd Node TCP 8853 BOSH DNS health
Kubernetes Cluster Control Plane/etcd Node Kubernetes Cluster Worker Node TCP 4194 cAdvisor
Kubernetes Cluster Control Plane/etcd Node Kubernetes Cluster Worker Node TCP 10250 kubelet API
Kubernetes Cluster Control Plane/etcd Node Kubernetes Cluster Worker Node TCP 31194 cAdvisor
Kubernetes Cluster Control Plane/etcd Node NSX API VIP TCP 443 HTTPS
Kubernetes Cluster Control Plane/etcd Node TKGI Controller TCP 8443 HTTPSCA
Kubernetes Cluster Control Plane/etcd Node TKGI Controller TCP 8853 BOSH DNS health
Kubernetes Cluster Control Plane/etcd Node vCenter Server TCP 443 HTTPS
Kubernetes Cluster Worker Node BOSH Director TCP 4222 BOSH NATS server
Kubernetes Cluster Worker Node BOSH Director TCP 25250 BOSH BlobStore
Kubernetes Cluster Worker Node BOSH Director TCP 25923 health monitor daemon
Kubernetes Cluster Worker Node Harbor Private Image Registry TCP 443 HTTPS
Kubernetes Cluster Worker Node Harbor Private Image Registry TCP 8853 BOSH DNS health
Kubernetes Cluster Worker Node IP NAS Storage Array TCP 111 nfs rpc portmapper
Kubernetes Cluster Worker Node IP NAS Storage Array TCP 2049 nfs
Kubernetes Cluster Worker Node Kubernetes Cluster Control Plane/etcd Node TCP 8443 HTTPSCA
Kubernetes Cluster Worker Node Kubernetes Cluster Control Plane/etcd Node TCP 8853 BOSH DNS health
Kubernetes Cluster Worker Node Kubernetes Cluster Control Plane/etcd Node TCP 10250 kubelet API
pks-system pod/cert-generator TKGI Controller TCP 24224 Fluentd out_forward
pks-system pod/fluent-bit TKGI Controller TCP 24224 Fluentd out_forward



VMware Ports and Protocols

The following tables list ports and protocols required for network communication between VMware components. For additional information, see VMware Ports and Protocols.


VMware Virtual Infrastructure Ports and Protocols

The following table lists ports and protocols used for network communication between VMware virtual infrastructure components.

Source Component Destination Component Destination Protocol Destination Port Service
vCenter Server NSX Manager/Controller Node TCP 8080 HTTP alt
vCenter Server vSphere ESXI Hosts Mgmt. vmknic TCP 443 HTTPS
vCenter Server vSphere ESXI Hosts Mgmt. vmknic TCP 8080 HTTP alt
vCenter Server vSphere ESXI Hosts Mgmt. vmknic TCP 9080 io filter storage
vSphere ESXI Hosts Mgmt. vmknic NSX Manager/Controller Node TCP 443 HTTPS
vSphere ESXI Hosts Mgmt. vmknic NSX Manager/Controller Node TCP 1235 netcpa
vSphere ESXI Hosts Mgmt. vmknic NSX Manager/Controller Node TCP 5671 AMQP traffic
vSphere ESXI Hosts Mgmt. vmknic NSX Manager/Controller Node TCP 8080 HTTP alt
vSphere ESXI Hosts Mgmt. vmknic vCenter Server UDP 902 ideafarm-door
vSphere ESXI Hosts Mgmt. vmknic vCenter Server TCP 9084 update manager
vSphere ESXI Hosts Mgmt. vmknic vSphere ESXI Hosts Mgmt. vmknic TCP 8182 vSphere ha
vSphere ESXI Hosts Mgmt. vmknic vSphere ESXI Hosts Mgmt. vmknic UDP 8182 vSphere ha
vSphere ESXI Hosts vMotion vmknic vSphere ESXI Hosts vMotion vmknic TCP 8000 vmotion
vSphere ESXI Hosts IP Storage vmknic IP NAS Storage Array TCP 111 NFS RPC portmapper
vSphere ESXI Hosts IP Storage vmknic IP NAS Storage Array TCP 2049 NFS
vSphere ESXI Hosts IP Storage vmknic IP NAS Storage Array TCP 3260 iscsi
vSphere ESXI Hosts vSAN vmknic vSphere ESXI Hosts vSAN vmknic TCP 2233 vSAN transport
vSphere ESXI Hosts vSAN vmknic vSphere ESXI Hosts vSAN vmknic UDP 12321 unicast agent
vSphere ESXI Hosts vSAN vmknic vSphere ESXI Hosts vSAN vmknic UDP 12345 vSAN cluster svc
vSphere ESXI Hosts vSAN vmknic vSphere ESXI Hosts vSAN vmknic UDP 23451 vSAN cluster svc
vSphere ESXI Hosts TEP vmknic vSphere ESXI Hosts TEP vmknic UDP 3784 bfd
vSphere ESXI Hosts TEP vmknic vSphere ESXI Hosts TEP vmknic UDP 3785 bfd
vSphere ESXI Hosts TEP vmknic vSphere ESXI Hosts TEP vmknic UDP 6081 geneve
vSphere ESXI Hosts TEP vmknic NSX Edge TEP vNIC UDP 3784 bfd
vSphere ESXI Hosts TEP vmknic NSX Edge TEP vNIC UDP 3785 bfd
vSphere ESXI Hosts TEP vmknic NSX Edge TEP vNIC UDP 6081 geneve
vSphere ESXI Hosts TEP vmknic NSX Manager/Controller TCP 1234 NSX messaging
NSX Manager/Controller Node NSX API VIP TCP 443 HTTPS
NSX Manager/Controller Node NSX Manager/Controller Node TCP 443 HTTPS
NSX Manager/Controller Node NSX Manager/Controller Node TCP 5671 AMQP traffic
NSX Manager/Controller Node NSX Manager/Controller Node TCP 8080 HTTP alt
NSX Manager/Controller Node NSX Manager/Controller Node TCP 9000 loginsight ingestion api
NSX Manager/Controller Node Traceroute Destination UDP 33434-33523 traceroute
NSX Manager/Controller Node vCenter Server TCP 80 HTTP
NSX Manager/Controller Node vCenter Server TCP 443 HTTPS
NSX Manager/Controller Node vSphere ESXI Hosts Mgmt. vmknic TCP 443 HTTPS
NSX Edge Management NSX Edge Management TCP 1167 DHCP backend
NSX Edge Management NSX Edge Management TCP 2480 Nestdb
NSX Edge Management NSX Edge Management UDP 3784 bfd
NSX Edge Management NSX Edge Management UDP 50263 high-availability
NSX Edge Management NSX Manager/Controller Node TCP 443 HTTPS
NSX Edge Management NSX Manager/Controller Node TCP 1235 netcpa
NSX Edge Management NSX Manager/Controller Node TCP 5671 AMQP traffic
NSX Edge Management NSX Manager/Controller Node TCP 8080 HTTP alt
NSX Edge Management Traceroute Destination UDP 33434-33523 traceroute
NSX Edge TEP vNIC NSX Edge TEP vNIC UDP 3784 bfd
NSX Edge TEP vNIC NSX Edge TEP vNIC UDP 3785 bfd
NSX Edge TEP vNIC NSX Edge TEP vNIC UDP 6081 geneve
NSX Edge TEP vNIC NSX Edge TEP vNIC UDP 50263 high-availability
NSX Edge TEP vNIC vSphere ESXI Hosts TEP vmknic UDP 3784 bfd
NSX Edge TEP vNIC vSphere ESXI Hosts TEP vmknic UDP 3785 bfd
NSX Edge TEP vNIC vSphere ESXI Hosts TEP vmknic UDP 6081 geneve
NSX Edge Tier-0 Uplink IP(s) / HA VIP Physical Network Router TCP 179 bgp
NSX Edge TEP vNIC NSX Manager/Controller TCP 1234 NSX messaging
NSX Tier-1 Router Kubernetes cluster Pods and Worker Nodes TCP 80 HTTP
NSX Tier-1 Router Kubernetes cluster Pods and Worker Nodes TCP 443 HTTPS
NSX Tier-1 Router Kubernetes cluster Pods and Worker Nodes TCP 8443 HTTPSCA
Physical Network Router NSX Edge Tier-0 Uplink IP(s) / HA VIP TCP 179 bgp


VMware Optional Integration Ports and Protocols

The following table lists ports and protocols used for network communication between optional VMware integrations.

Source Component Destination Component Destination Protocol Destination Port Service
Admin/Operator Console vRealize Operations Manager TCP 443 HTTPS
vRealize Operations Manager Kubernetes Cluster API Server -LB VIP TCP 8443 HTTPSCA
vRealize Operations Manager NSX API VIP TCP 443 HTTPS
vRealize Operations Manager TKGI Controller TCP 8443 HTTPSCA
vRealize Operations Manager Kubernetes Cluster API Server -LB VIP TCP 8443 HTTPSCA
Admin/Operator Console vRealize LogInsight TCP 443 HTTPS
Kubernetes Cluster Ingress Controller vRealize LogInsight TCP 9000 ingestion api
Kubernetes Cluster Control Plane/Etcd Node vRealize LogInsight TCP 9000 ingestion api
Kubernetes Cluster Control Plane/Etcd Node vRealize LogInsight TCP 9543 ingestion api -tls
Kubernetes Cluster Worker Node vRealize LogInsight TCP 9000 ingestion api
Kubernetes Cluster Worker Node vRealize LogInsight TCP 9543 ingestion api -tls
NSX Manager/Controller Node vRealize LogInsight TCP 9000 ingestion api
TKGI Controller vRealize LogInsight TCP 9000 ingestion api
Admin/Operator and Developer Consoles Wavefront SaaS APM TCP 443 HTTPS
kube-system pod/wavefront-proxy Wavefront SaaS APM TCP 443 HTTPS
kube-system pod/wavefront-proxy Wavefront SaaS APM TCP 8443 HTTPSCA
pks-system pod/wavefront-collector TKGI Controller TCP 24224 Fluentd out_forward
Admin/Operator Console vRealize Network Insight Platform TCP 443 HTTPS
Admin/Operator Console vRealize Network Insight Proxy TCP 22 SSH
vRealize Network Insight Proxy Kubernetes Cluster API Server -LB VIP TCP 8443 HTTPSCA
vRealize Network Insight Proxy NSX API VIP TCP 22 SSH
vRealize Network Insight Proxy NSX API VIP TCP 443 HTTPS
vRealize Network Insight Proxy TKGI Controller TCP 8443 HTTPSCA
vRealize Network Insight Proxy TKGI Controller TCP 9021 TKGI API server
check-circle-line exclamation-circle-line close-line
Scroll to top icon