DETalk to us →
ClusterPilot Docs
v0.0.1 RC · fcc5871
Start with:EvaluateInstallCreate a clusterOperateRecoverAutomate
Documentation/Install
Install · v0.0.1

Network, ports and trust

Required communication paths, default ports, TLS boundaries, allow-lists and unsupported trust shortcuts.

AudienceNetwork · security · platform teamsReading time14 minutesCommands in context2 guided stepsReviewed sourcefcc5871 · 30 July 2026
RC

Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.

Required flow matrix

FlowProtocolDefaultPurpose / boundary
Operators / automation → edgeHTTPS443/TCPUI, API and supported authentication boundary
Edge → APIHTTP or HTTPS8080/TCP defaultLoopback plaintext only for trusted single-host profile
API / workers → PostgreSQLPostgreSQL5432/TCPDurable control-plane state
API / workers → S3-compatible artifactsHTTPS443/TCPOnly for s3-compatible provider
API / agents → registry and release sourcesHTTPS443/TCPDigest and metadata resolution; no unapproved fallback
Agents → ClusterPilot APIHTTPS443/TCPHeartbeat, work polling, evidence and result submission
Agents → provider APIsHTTPS443/TCPOnly the configured provider allow-list
Lifecycle agents → target hostsSSH22/TCP defaultNode preparation and bounded lifecycle commands
Nodes ↔ Kubernetes APIHTTPS6443/TCP defaultkubeadm control-plane traffic
Cluster nodesKubernetes / CNIRelease and CNI specificUse the approved kubeadm and Calico port matrix
All hosts → time sourceNTP or approved local time123/UDP or local policyClock health is an execution gate

Trust rules

  • ✓
    Terminate customer-facing TLS at the approved edge on 443/TCP
  • ✓
    Plaintext edge-to-API is supported only on loopback within the trusted single-host profile
  • ✓
    Install private CA trust on every API, worker and agent that needs it
  • ✓
    Keep registry credentials and trust bundles scoped to distribution pulls
  • ✓
    Allow provider endpoints explicitly; private/local endpoints require the intentional private-endpoint policy
  • ✓
    Never use insecureSkipTlsVerify as a production workaround

Firewall workflow

  1. 01

    Start from deny-by-default

    Document every allowed source, destination, protocol, port and owner.

  2. 02

    Open control-plane dependencies

    Edge, PostgreSQL, artifacts, registry, DNS, time and observability.

  3. 03

    Open execution dependencies

    Agent-to-API, provider APIs, target SSH and the chosen Kubernetes/CNI matrix.

  4. 04

    Validate from the actual runtime

    Test from API pods/hosts and each agent, not from an administrator laptop.

  5. 05

    Retain the approved matrix

    Attach firewall change identifiers and validation evidence to the deployment record.

Unsupported shortcuts