Firewall rules¶
Firewall rules control ingress to worker nodes on a Ready cluster: protocol, port range (or ICMP type and code), and source IPv4 networks. Use them to allow an office network to an application port, including traffic that arrives on an Elastic IP.
They do not filter the Kubernetes API. Who can reach the API is exposure only.
Who can do this: a member can list rules. Creating and deleting them requires super_admin. The cluster must be Ready.
In the console¶
There is no firewall editor in the Door console. The Networking tab shows Elastic IPs only. Maya has no firewall action. Firewall rules are an automation feature today. If you do not script and need a port opened, contact your Door account team.
Create, list, and delete rules from the API reference. Each rule is ingress toward the workers:
| You set | Effect |
|---|---|
| Protocol | tcp, udp, or icmp |
| Ports | For TCP and UDP, a port or a range (1–65535). For ICMP, type and code (echo request is type 8, code 0) |
| Source networks | IPv4 CIDRs, at most 16. If you omit them, the source is 0.0.0.0/0 |
| Name | Optional DNS label, unique among the cluster's rules |
If you create no rules, Door does not open extra application ports for you. Open each port you need, for example TCP 443.
Direction is always ingress. IPv6 is not supported. Deleting the cluster removes its rules.
With Maya¶
Maya cannot create or delete firewall rules. Use the API reference.
Next