Port 39045 on worker nodes

[boris-tsigelman]

Hello,

After installing k3s worker, port 39045 was opened on the worker node.
I can't find documentation for this port.

Can someone please tell what is it used for and if the communication on this port is secure (tls)?

Thanks,
Boris.

[brandond]

This isn't a fixed port used by a K3s. What process do you see listening on this port?

[boris-tsigelman]

You are correct, after another k3s installation, port 39045 is no longer open.
But port 45127 is now open and used by k3s agent.
Please note these ports are open on a worker node, not master.

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:45127         0.0.0.0:*               LISTEN      6636/k3s agent

So what is the propose of these random ports?
I need to configure a firewall for k3s ports and I can't just open an arbitrary range for these random ports...
I also don't know what port range these random ports use.

Thanks :-)

[brandond]

If you run kubectl get service -n kube-system traefik you should see two randomly-assigned node ports for the LoadBalancer service. You don't need to expose these; you should instead expose the external ports (80 and 443). The svclb (ServiceLB) pods handle forwarding traffic from the external port to the node port.

[boris-tsigelman]

@brandond Thank you for replying :-)

The ports I was asking about are not the ones opened by traefik service.
After running kubectl get service -n kube-system traefik I get this:

NAME      TYPE           CLUSTER-IP      EXTERNAL-IP    PORT(S)                      AGE
traefik   LoadBalancer   10.43.120.221   11.10.10.204   80:32571/TCP,443:32594/TCP   24m

The two nodeports are: 32571 and 32594.

After sshing into all worker nodes and checking which ports are open, I can see the two ports that were opened by traefik, but I also see additional ports that I can't recognize.

Here are the unidentified ports on the worker nodes:
Worker1 Port: 40586
Worker2 Port: 43450
Worker3 Port: 39632

Please look at the ports opened in each worker node (after k3s install).
I've removed unrelated ports from the list for clarification.
You can see that ports 32571 and 32594 are open on each node, and you can also see the unidentified ports I've listed above.

Please advise.

Worker 1
-------------------------------------------------------
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:40586         0.0.0.0:*               LISTEN      8171/k3s agent
tcp        0      0 0.0.0.0:32594           0.0.0.0:*               LISTEN      8171/k3s agent
tcp        0      0 0.0.0.0:32571           0.0.0.0:*               LISTEN      8171/k3s agent


Worker 2
-------------------------------------------------------
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:43450         0.0.0.0:*               LISTEN      8020/k3s agent
tcp        0      0 0.0.0.0:32594           0.0.0.0:*               LISTEN      8020/k3s agent
tcp        0      0 0.0.0.0:32571           0.0.0.0:*               LISTEN      8020/k3s agent


Worker 3
-------------------------------------------------------
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:39632         0.0.0.0:*               LISTEN      8041/k3s agent
tcp        0      0 0.0.0.0:32594           0.0.0.0:*               LISTEN      8171/k3s agent
tcp        0      0 0.0.0.0:32571           0.0.0.0:*               LISTEN      8171/k3s agent

Thank you,
Boris.

[brandond]

I'm confused then, you mentioned opening ports on a firewall. These ports are bound to localhost only; they can't be connected to from other hosts, so you couldn't open access to them via a firewall if you tried.

[boris-tsigelman]

Hi @brandond,

Thanks for clarifying :-)
I misunderstood the netstat output.
Sorry for the inconvenience.

Thanks,
Boris.