From ccc832f4680f91c26d9b18e91a3b3a5f8cdf573f Mon Sep 17 00:00:00 2001 From: Dalton Hubble Date: Mon, 6 Nov 2017 00:08:14 -0800 Subject: [PATCH] Add firewall rule to allow apiserver to proxy other controller kubelets * Prometheus proxies through the apiserver to scrape kubelets * In multi-controller setups, an apiserver must be able to scrape kubelets (10250) on other controllers --- aws/container-linux/kubernetes/controllers.tf | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/aws/container-linux/kubernetes/controllers.tf b/aws/container-linux/kubernetes/controllers.tf index bfd2f75e..10e4ead7 100644 --- a/aws/container-linux/kubernetes/controllers.tf +++ b/aws/container-linux/kubernetes/controllers.tf @@ -169,6 +169,16 @@ resource "aws_security_group_rule" "controller-node-exporter" { source_security_group_id = "${aws_security_group.worker.id}" } +resource "aws_security_group_rule" "controller-kubelet-self" { + security_group_id = "${aws_security_group.controller.id}" + + type = "ingress" + protocol = "tcp" + from_port = 10250 + to_port = 10250 + self = true +} + resource "aws_security_group_rule" "controller-kubelet-read" { security_group_id = "${aws_security_group.controller.id}"