K3s Networking and Firewall Standards

This rule applies to files matching the patterns above.

# K3s Networking and Firewall Standards

## Rule
All K3s clusters MUST have proper firewall rules configured and network policies enabled to restrict inter-pod traffic.

## Required Ports

### Server Nodes
| Port | Protocol | Direction | Purpose |
|------|----------|-----------|---------|
| 6443 | TCP | Inbound | Kubernetes API server |
| 2379-2380 | TCP | Server-to-Server | etcd client/peer |
| 10250 | TCP | Inbound | Kubelet metrics |
| 8472 | UDP | All nodes | VXLAN (Flannel) |
| 51820 | UDP | All nodes | WireGuard (if enabled) |

### Agent Nodes
| Port | Protocol | Direction | Purpose |
|------|----------|-----------|---------|
| 10250 | TCP | Inbound | Kubelet metrics |
| 8472 | UDP | All nodes | VXLAN (Flannel) |
| 30000-32767 | TCP | Inbound | NodePort services |

## Examples

### Good — Firewall Configuration
```bash
# Server node firewall (ufw example)
sudo ufw allow from 10.0.0.0/24 to any port 6443   # API server from trusted network
sudo ufw allow from 10.0.0.0/24 to any port 2379:2380/tcp  # etcd
sudo ufw allow from 10.0.0.0/24 to any port 10250/tcp      # kubelet
sudo ufw allow from 10.0.0.0/24 to any port 8472/udp       # VXLAN
sudo ufw deny from any to any port 6443  # Block public API access
```

### Good — Network Policy (Default Deny)
```yaml
# Apply to every namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
```

### Bad
```bash
# No firewall rules — all ports exposed
# No network policies — all pods can communicate freely
sudo ufw disable
```

## Enforcement
Deploy default-deny NetworkPolicies via GitOps. Validate firewall rules with port scanning during security audits. Use admission controllers to reject pods without matching NetworkPolicies.