Version: v26.06

Communication Matrix ​

Host Port Usage List ​

Host Exposed Ports ​

Source DeviceSource IPSource PortDestination DeviceDestination IPDestination Port (Listening)ProtocolPort DescriptionListening Port ConfigurableAuthentication ModeEncryption ModeService/MicroserviceRemarks
ALLALLALLopenFuyao ServerHost IP36443TCPHost exposed port (HostPort)YesPassword authentication and one-way certificate authenticationTLS1.3 (default)/TLS1.2kubernetesForwarded to PodIP:36443 via CNI-HOSTPORT rules
ALLALLALLopenFuyao ServerHost IP38080TCPHost exposed port (HostPort)YesNone, standard TCP protocolNonebocloud_chart_registryForwarded to PodIP:8080 via CNI-HOSTPORT rules
ALLALLALLopenFuyao ServerHost IP40080TCPHost exposed port (HostPort)YesNone, standard TCP protocolNonebocloud_yum_registryForwarded to PodIP:80 via CNI-HOSTPORT rules
ALLALLALLopenFuyao ServerHost IP40443TCPHost exposed port (HostPort)YesOne-way certificate authenticationTLS1.3 (default)/TLS1.2bocloud_image_registryForwarded to PodIP:443 via CNI-HOSTPORT rules
ALLALLALLopenFuyao ServerHost IP30010TCPHost exposed port (NodePort)NoUsername and password authenticationTLS1.3 (default)/TLS1.2ingress-nginx-controllerExposed via Kubernetes NodePort
ALLALLALLopenFuyao ServerHost IP31616TCPHost exposed port (NodePort)NoUsername and password authenticationTLS1.3 (default)/TLS1.2ingress-nginx-controllerExposed via Kubernetes NodePort
ALLALLALLopenFuyao ServerHost IP22TCPHost process listening portNoPassword/key authenticationSSH encryptionsshd-
ALLALLALLopenFuyao ServerHost IP123UDPHost process listening portNoNone, standard UDP protocolNonebke-
ALLALLALLopenFuyao ServerHost IP6443TCPHost process listening portYesPassword authentication and one-way certificate authenticationTLS1.3 (default)/TLS1.2kube-apiserver-
ALLALLALLopenFuyao ServerHost IP10250TCPHost process listening portYesToken authentication and certificate authenticationTLS1.3 (default)/TLS1.2kubelet-
ALLALLALLopenFuyao ServerHost IP10249TCPHost process listening portYesNone, standard TCP protocolNonekube-proxy-
ALLALLALLopenFuyao ServerHost IP10256TCPHost process listening portYesNone, standard TCP protocolNonekube-proxy-
ALLALLALLopenFuyao ServerHost IP10257TCPHost process listening portYesTwo-way certificate authenticationTLS1.3 (default)/TLS1.2kube-controller-manager-
ALLALLALLopenFuyao ServerHost IP10259TCPHost process listening portYesTwo-way certificate authenticationTLS1.3 (default)/TLS1.2kube-scheduler-
ALLALLALLopenFuyao ServerHost IP2379TCPHost process listening portYesTwo-way certificate authenticationTLS1.3 (default)/TLS1.2etcd-
ALLALLALLopenFuyao ServerHost IP2380TCPHost process listening portYesTwo-way certificate authenticationTLS1.3 (default)/TLS1.2etcd-
ALLALLALLopenFuyao ServerHost IP2381TCPHost process listening portYesNone, standard TCP protocolNoneetcd-
ALLALLALLopenFuyao ServerHost IP8443TCPHost process listening portYesOne-way certificate authenticationTLS1.3 (default)/TLS1.2socat-
ALLALLALLopenFuyao ServerHost IP9100TCPHost process listening portYesNone, standard TCP protocolNonekube-rbac-proxy-
ALLALLALLopenFuyao ServerHost IP4789UDPHost process listening portYesNone, standard UDP protocolNonecalico/vxlan-

Host Local Dependency Ports ​

Source DeviceSource IPSource PortDestination DeviceDestination IPDestination Port (Listening)ProtocolPort DescriptionListening Port ConfigurableAuthentication ModeEncryption ModeService/MicroserviceRemarks
ALLALLALLopenFuyao ServerLoopback address1338TCPHost local process listening port (required for deployment/runtime)YesNone, standard TCP protocolNonecontainerdLocal access only
ALLALLALLopenFuyao ServerLoopback address10248TCPHost local process listening port (required for deployment/runtime)YesNone, standard TCP protocolNonekubeletLocal access only
ALLALLALLopenFuyao ServerLoopback address9099HTTPHost local process listening port (required for deployment/runtime)YesNone, standard TCP protocolNonecalico-nodeLocal access only
ALLALLALLopenFuyao ServerLoopback address58080HTTPHost local process listening port (required for deployment/runtime)YesNone, standard TCP protocolNonebkeagentLocal access only
ALLALLALLopenFuyao ServerLoopback address323UDPHost local process listening port (required for deployment/runtime)YesNone, standard UDP protocolNonechronydOnly exists if chronyd is enabled on the node

Note:
This section categorizes ports related to cluster deployment/runtime into "Host Exposed Ports" and "Host Local Dependency Ports." The former includes both host process listening ports that can be directly observed via ss/netstat, as well as reachable ports formed by NodePort and HostPort/CNI DNAT forwarding. The latter typically only binds 127.0.0.1/::1 and is not externally exposed, but is depended upon by component deployment, health checks, or runtime communication. If occupied, it may also cause component startup failures, health check anomalies, or cluster startup failures.

Kubernetes Communication Matrix ​

Source DeviceSource IPSource PortDestination DeviceDestination IPDestination Port (Listening)ProtocolPort DescriptionListening Port ConfigurableAuthentication ModeEncryption ModeService/MicroserviceRemarks
ALLALLALLopenFuyao ServerCluster IP6443TCPUsed by third-party systems to obtain the aggregated service capabilities provided by openFuyao through this port. It is the listening port of kube-apiserver, which is an SSL-encrypted port.YesPassword authentication and one-way certificate authenticationTLS1.3 (default)/TLS1.2kube-apiserver-
ALLALLALLopenFuyao ServerCluster IP443TCPUsed by third-party systems to obtain the aggregated service capabilities provided by openFuyao through this port. It is the listening port of kube-apiserver, which is an SSL-encrypted port.NoToken authentication or one-way certificate authenticationTLS1.3 (default)/TLS1.2kube-apiserver-
ALLALLALLopenFuyao ServerLoopback address10257TCPUsed to access the HTTPS service of kube-controller-manager. It is the listening port of kube-controller-manager, which is an SSL-encrypted port.YesTwo-way certificate authenticationTLS1.3 (default)/TLS1.2kube-controller-manager-
ALLALLALLopenFuyao ServerLoopback address10259TCPUsed to access the HTTPS service of kube-scheduler. It is the listening port of kube-scheduler, which is an SSL-encrypted port.YesTwo-way certificate authenticationTLS1.3 (default)/TLS1.2kube-scheduler-
ALLALLALLopenFuyao ServerCluster IP53TCP/UDPUsed for service domain name resolution. It is the listening port of coredns, used only for domain name resolution.NoNone, standard TCP protocolNonecoredns-
ALLALLALLopenFuyao ServerCluster IP9153TCPUsed to collect monitoring metrics of coredns.YesNone, standard TCP protocolTLS1.3 (default)/TLS1.2coredns-
ALLALLALLopenFuyao ServerCluster IP8080TCPUsed to check the health status of coredns.YesNone, standard TCP protocolTLS1.3 (default)/TLS1.2coredns-
ALLALLALLopenFuyao ServerCluster IP2379TCPetcd provides services through this port, which is an SSL-encrypted port.YesTwo-way certificate authenticationTLS1.3 (default)/TLS1.2etcd-
ALLALLALLopenFuyao ServerCluster IP2380TCPUsed for communication between etcd cluster members, which is an SSL-encrypted port.YesTwo-way certificate authenticationTLS1.3 (default)/TLS1.2etcd-
ALLALLALLopenFuyao ServerCluster IP2381TCPUsed to collect monitoring metrics externally provided by the etcd cluster.YesNone, standard TCP protocolTLS1.3 (default)/TLS1.2etcd-
ALLALLALLopenFuyao ServerLoopback address9099HTTPUsed to provide service liveness status check functionality.YesNone, standard TCP protocolNonecalico-node-
ALLALLALLopenFuyao ServerCluster IP179TCPcalico component bird BGP protocol listening port, used for synchronizing routes between nodes.YesPassword authenticationNonecalico-node-
ALLALLALLopenFuyao ServerLoopback address10248TCPUsed to check the health status of kubelet.YesNone, standard TCP protocolNonekubelet-
ALLALLALLopenFuyao ServerCluster IP10250TCPUsed to communicate with kube-apiserver, which is an SSL-encrypted port.YesToken authentication and certificate authenticationTLS1.3 (default)/TLS1.2kubelet-
ALLALLALLopenFuyao ServerLoopback address10249TCPUsed to collect monitoring metrics.YesNone, standard TCP protocolNonekube-proxy-
ALLALLALLopenFuyao ServerLoopback address10256TCPUsed for health status check.YesNone, standard TCP protocolNonekube-proxy-

Note:
For the Kubernetes official documentation, see Ports and Protocols.

openFuyao Application Component Communication Matrix ​

Source DeviceSource IPSource PortDestination DeviceDestination IPDestination Port (Listening)ProtocolPort DescriptionListening Port ConfigurableAuthentication ModeEncryption ModeService/MicroserviceRemarks
ALLALLALLopenFuyao ServerPodIP443TCPingress-nginx-controller service portNoUsername and password authenticationTLS1.3 (default)/TLS1.2ingress-nginx-controller-
ALLALLALLopenFuyao ServerCluster IP443TCPingress-nginx-controller service portNoUsername and password authenticationTLS1.3 (default)/TLS1.2ingress-nginx-controller-
ALLALLALLopenFuyao ServerIngressIP30010TCPBootstrap node management plane externally provided access portNoUsername and password authenticationTLS1.3 (default)/TLS1.2ingress-nginx-controller-
ALLALLALLopenFuyao ServerIngressIP31616TCPBusiness cluster & management cluster management plane externally provided access portNoUsername and password authenticationTLS1.3 (default)/TLS1.2ingress-nginx-controller-
ALLALLALLopenFuyao ServerCluster IP9072TCPweb-terminal-service backend Pod access portYesToken authenticationTLS1.3 (default)/TLS1.2web-terminal-service-
ALLALLALLopenFuyao ServerPodIP9072TCPweb-terminal-service backend Service access portYesToken authenticationTLS1.3 (default)/TLS1.2web-terminal-service-
ALLALLALLopenFuyao ServerPodIP80TCPmonitoring-service backend Pod access portYesNone, standard TCP protocolNonemonitoring-service-
ALLALLALLopenFuyao ServerPodIP9096TCPBuilt-in authentication server Pod access portYesTwo-way certificate authenticationTLS1.3oauth-server-
ALLALLALLopenFuyao ServerCluster IP9096TCPBuilt-in authentication server Service access portYesTwo-way certificate authenticationTLS1.3oauth-server-
ALLALLALLopenFuyao ServerPodIP9095TCPAuthentication webhook Pod access portYesTwo-way certificate authenticationTLS1.3oauth-webhook-
ALLALLALLopenFuyao ServerCluster IP9095TCPAuthentication webhook Service access portYesTwo-way certificate authenticationTLS1.3oauth-webhook-
ALLALLALLopenFuyao ServerPodIP9175TCPUser management service Pod access portYesNone, standard TCP protocolNoneuser-management-operator-
ALLALLALLopenFuyao ServerCluster IP80TCPUser management service Service access portYesNone, standard TCP protocolNoneuser-management-operator-
ALLALLALLopenFuyao ServerPodIP9093TCPApplication management service backend Pod access portYesNone, standard TCP protocolNoneapplication-management-service-
ALLALLALLopenFuyao ServerCluster IP80TCPApplication management service backend Service access portYesNone, standard TCP protocolNoneapplication-management-service-
ALLALLALLopenFuyao ServerPodIP9093TCPApplication market service backend Pod access portYesNone, standard TCP protocolNonemarketplace-service-
ALLALLALLopenFuyao ServerCluster IP80TCPApplication market service backend Service access portYesNone, standard TCP protocolNonemarketplace-service-
ALLALLALLBootstrap NodePodIP8080TCPCluster lifecycle management frontend Pod access portYesNone, standard TCP protocolNoneinstaller-website-
ALLALLALLBootstrap NodeCluster IP80TCPCluster lifecycle management frontend Service access portYesNone, standard TCP protocolNoneinstaller-website-
ALLALLALLBootstrap NodePodIP9210TCPCluster lifecycle management backend Pod access portYesNone, standard TCP protocolNoneinstaller-service-
ALLALLALLBootstrap NodeCluster IP80TCPCluster lifecycle management backend Service access portYesNone, standard TCP protocolNoneinstaller-service-
ALLALLALLBootstrap NodePodIP8080TCPBootstrap node externally provided console frontend Pod access portYesNone, standard TCP protocolNonebke-console-website-
ALLALLALLBootstrap NodeCluster IP80TCPBootstrap node externally provided console frontend Service access portYesNone, standard TCP protocolNonebke-console-website-
ALLALLALLBootstrap NodePodIP9037TCPBootstrap node externally provided console backend Pod access portYesNone, standard TCP protocolNonebke-console-website-
ALLALLALLBootstrap NodeCluster IP80TCPBootstrap node externally provided console backend Service access portYesNone, standard TCP protocolNonebke-console-website-
ALLALLALLopenFuyao ServerPodIP9093TCPExtension component management backend Pod access portYesNone, standard TCP protocolNoneplugin-management-service-
ALLALLALLopenFuyao ServerCluster IP80TCPExtension component management backend Service access portYesNone, standard TCP protocolNoneplugin-management-service-
ALLALLALLopenFuyao ServerCluster IP9100TCPNode Exporter Service access portYesNone, standard TCP protocolNonenode-exporter-
ALLALLALLBootstrap NodeContainer IP36443HTTPSBootstrap node externally provided K8s API portYesPassword authentication and one-way certificate authenticationTLS1.3 (default)/TLS1.2kubernetes-
ALLALLALLBootstrap NodeContainer IP38080HTTPBootstrap node externally provided charts service portYesNone, standard TCP protocolNonebocloud_chart_registry-
ALLALLALLBootstrap NodeContainer IP40080HTTPBootstrap node externally provided yum repository service portYesNone, standard TCP protocolNonebocloud_yum_registry-
ALLALLALLBootstrap NodeContainer IP40443HTTPSBootstrap node externally provided image repository service portYesOne-way certificate authenticationTLS1.3 (default)/TLS1.2bocloud_image_registry-
ALLALLALLopenFuyao ServerCluster IP8443HTTPSHealth probe portYesOne-way certificate authenticationTLS1.3 (default)/TLS1.2bkeagent-deployer-
ALLALLALLopenFuyao ServerCluster IP3377HTTPHealth probe portYesNoneNonebkeagent-launcher-
ALLALLALLopenFuyao ServerLoopback address58080HTTPSystem service listening portYesNone, standard TCP protocolNonebkeagent-

Note:
For communication port information of components installed through the application market, please consult the relevant component providers.

View source on GitCode

Licensed under the MulanPSL2

Copyright © 2026 openFuyao. All rights reserved.ICP Record Number: YueA2-20044005-306YueGongWangAnBei No.44030002007300
隐私政策法律声明关于cookies
隐私政策法律声明关于cookies
Licensed underthe MulanPSL2
Copyright © 2026 openFuyao. All rights reserved.
YueGongWangAnBei No.44030002007300ICP Record Number: YueA2-20044005-306