docs: add a howto for configuring UFW #1642

ktsakalozos · 2025-07-11T11:22:41Z

Description

We do not have a firewall configuration howto

Solution

Add a howto

Checklist

nhennigan

Thanks Kos! I think this is an important page that many users will need. I have left a few comments but they are mainly minor nits

docs/canonicalk8s/snap/howto/networking/ufw.md

nhennigan · 2025-07-11T18:12:27Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+net.ipv4.ip_forward=1
+```
+
+Apply immediately:


Is there a reason you have to do it immediately? Is the timing important?

Here immediately means "without rebooting the system".

nhennigan · 2025-07-11T18:13:27Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+
+## Install and enable UFW
+
+To install Uncomplicated Firewall:


Do we need to install this on every node?

Yes, UFW needs to be installed on all nodes.

docs/canonicalk8s/snap/howto/networking/ufw.md

nhennigan · 2025-07-11T18:16:39Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+## Allow CNI specific communication
+
+The default CNI used in {{product}} is cilium.
+Unless you are not disabling this network plugin and deploying your own,


Suggestion instead of the negative version of this sentence:
If you are using the default network plugin, you should consider the following firewall rules:

docs/canonicalk8s/snap/howto/networking/ufw.md

nhennigan · 2025-07-11T18:52:01Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+Kubelet runs on all nodes, while the kube-controller-manager and
+kube-scheduler run only on the control plane nodes:
+
+Allow traffic on port 10250 on all nodes:


Suggestion to make it clear which port is for which service:

Kubelet runs on all nodes, so allow traffic on port 10250 on all nodes: //code here sudo ufw allow 10250/tcp The kube-controller-manager and kube-scheduler run only on the control plane nodes so allow traffic on ports 10257 and 10259 on control plane nodes: //code here sudo ufw allow 10257/tcp sudo ufw allow 10259/tcp

nhennigan · 2025-07-11T18:53:03Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+
+## Allow cluster formation
+
+To form an HA cluster the datastore used by Kubernetes (dqlite/etcd) needs


Suggested change

To form an HA cluster the datastore used by Kubernetes (dqlite/etcd) needs

To form a High Availability (HA) cluster the datastore used by Kubernetes (dqlite/etcd) needs

nhennigan · 2025-07-11T18:55:58Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+
+```sh
+tail -f /var/log/ufw.log
+```


What can you learn form these logs? Which ports are trying to be accessed? Maybe we should add a comment here along the lines of "you should be able to see where the traffic is being dropped" or "this may help you identify any other ports or services you need to enable with UTW"

Co-authored-by: Niamh Hennigan <[email protected]>

louiseschmidtgen

A couple of suggestions to improve the flow.

louiseschmidtgen · 2025-07-13T15:09:24Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+In this how-to we present a set of firewall rules/guidelines
+you should consider when setting up {{product}}.


Suggested change

In this how-to we present a set of firewall rules/guidelines

you should consider when setting up {{product}}.

This how-to presents a set of firewall rules/guidelines

that should be considered when setting up {{product}}.

(let's use an active voice)

louiseschmidtgen · 2025-07-13T15:12:58Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+Be aware that these rules may be incompatible with your network setup
+and we recommend you review and tune them to match your needs.  


This sounds like a note can we format it accordingly please?
So starting with: ```{note}

louiseschmidtgen · 2025-07-13T15:16:54Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+Be aware that these rules may be incompatible with your network setup
+and we recommend you review and tune them to match your needs.  


Suggested change

Be aware that these rules may be incompatible with your network setup

and we recommend you review and tune them to match your needs.

Please be aware that these rules may be incompatible with your network setup, so we recommend reviewing and adjusting them to match your needs.

(active voice + causal conjunction)

louiseschmidtgen · 2025-07-13T15:19:01Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+Also, be aware that for each service hosted in Kubernetes,
+the firewall rules need to be reviewed as there might be
+special requirements for each.


Suggested change

Also, be aware that for each service hosted in Kubernetes,

the firewall rules need to be reviewed as there might be

special requirements for each.

Also, please review the firewall rules for each service hosted in Kubernetes, as there might be

special requirements for each.

louiseschmidtgen · 2025-07-13T15:22:46Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+- A machine with Ubuntu where you have installed
+  or you plan to install {{product}}.
+- You have root or sudo access to the machine.


Suggested change

- A machine with Ubuntu where you have installed

or you plan to install {{product}}.

- You have root or sudo access to the machine.

- An ubuntu machine where {{product}} is installed or will be installed.

- Root or sudo access to the machine.

(active voice)

louiseschmidtgen · 2025-07-13T15:53:19Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+If you are using the default network plugin (Cilium),
+you should consider the following firewall rules.


Suggested change

If you are using the default network plugin (Cilium),

you should consider the following firewall rules.

When using the default network plugin (Cilium),

consider the following firewall rules.

louiseschmidtgen · 2025-07-13T15:54:27Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+
+The logs will show you which packets are dropped, their destination
+and source as well as the protocol used and the destination port.
+This information may help you identify any other ports or services


Suggested change

This information may help you identify any other ports or services

This information helps to identify any other ports or services

louiseschmidtgen · 2025-07-13T15:55:03Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+This information may help you identify any other ports or services
+you need to enable within UFW.
+
+To keep the resources used by UFW to a minimum you can disable logging:


Suggested change

To keep the resources used by UFW to a minimum you can disable logging:

After troubleshooting, keep the resources used by UFW to a minimum by disabling logging again:

louiseschmidtgen · 2025-07-13T15:56:46Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+sudo sysctl -w net.ipv4.ip_forward=1
+```
+
+Reload UFW:


Suggested change

Reload UFW:

Reload UFW to apply the changes:

louiseschmidtgen · 2025-07-13T15:57:07Z

docs/canonicalk8s/snap/howto/networking/ufw.md

+
+## Allow access to the Kubernetes services
+
+Services such as CoreDNS require access to the Kubernetes API


We could add a link to CoreDNS docs here.

Add a howto for configuring UFW

f929763

ktsakalozos requested a review from a team as a code owner July 11, 2025 11:22

ktsakalozos added 4 commits July 11, 2025 14:24

Add a single line before code blocks

965ea21

Blank lines around headers

2e9f8ab

Add page to index

8d40fab

UFW is a good word

1c71504

nhennigan reviewed Jul 11, 2025

View reviewed changes

ktsakalozos and others added 7 commits July 11, 2025 23:33

Update docs/canonicalk8s/snap/howto/networking/ufw.md

bdf9a6b

Co-authored-by: Niamh Hennigan <[email protected]>

Update docs/canonicalk8s/snap/howto/networking/ufw.md

3f4d29c

Co-authored-by: Niamh Hennigan <[email protected]>

Update docs/canonicalk8s/snap/howto/networking/ufw.md

a25a9f6

Co-authored-by: Niamh Hennigan <[email protected]>

Update docs/canonicalk8s/snap/howto/networking/ufw.md

828cb49

Co-authored-by: Niamh Hennigan <[email protected]>

Update docs/canonicalk8s/snap/howto/networking/ufw.md

61f6da0

Co-authored-by: Niamh Hennigan <[email protected]>

Addressing comments

c81bdc1

Addressing more comments

3aa5ed1

ktsakalozos requested a review from nhennigan July 11, 2025 21:26

Addressing even more comments

c05f83c

louiseschmidtgen reviewed Jul 13, 2025

View reviewed changes

Something that looked funny

4c92fc6

nhennigan mentioned this pull request Aug 7, 2025

docs: fips how-to #1727

Merged

6 tasks


		## Allow cluster formation

		To form an HA cluster the datastore used by Kubernetes (dqlite/etcd) needs

	To form an HA cluster the datastore used by Kubernetes (dqlite/etcd) needs
	To form a High Availability (HA) cluster the datastore used by Kubernetes (dqlite/etcd) needs

		In this how-to we present a set of firewall rules/guidelines
		you should consider when setting up {{product}}.

		Be aware that these rules may be incompatible with your network setup
		and we recommend you review and tune them to match your needs.

	Be aware that these rules may be incompatible with your network setup
	and we recommend you review and tune them to match your needs.
	Please be aware that these rules may be incompatible with your network setup, so we recommend reviewing and adjusting them to match your needs.

		If you are using the default network plugin (Cilium),
		you should consider the following firewall rules.

	This information may help you identify any other ports or services
	This information helps to identify any other ports or services

	To keep the resources used by UFW to a minimum you can disable logging:
	After troubleshooting, keep the resources used by UFW to a minimum by disabling logging again:


		## Allow access to the Kubernetes services

		Services such as CoreDNS require access to the Kubernetes API

docs: add a howto for configuring UFW #1642

Are you sure you want to change the base?

docs: add a howto for configuring UFW #1642

Uh oh!

Conversation

ktsakalozos commented Jul 11, 2025

Description

Solution

Checklist

Uh oh!

nhennigan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

louiseschmidtgen left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

louiseschmidtgen left a comment •

edited

Loading