Firewall Prerequisites

Depending on your application architecture ARTESCA may require different firewall rules to be set up.

Single-Node Cluster

This is the simplest scenario where you just need to give the administrator access to management and workload services, and allow the applications to access the workload services, both via cluster IP.

Source	Destination	Port	Protocol	Description
Administrator IP	Control plane IP Workload plane IP *	22 8443 443 80	TCP	SSH Web-UI HTTPS workload Optional HTTP workload
Application Server IP	Workload plane IP	443 80	TCP	HTTPS workload Optional HTTP workload

Multi-Node Cluster without Load Balancer

Without a load balancer, ARTESCA can perform the load distribution itself by using virtual IPs. So, the firewall should allow the administrator to access the management by cluster IP and/or VIP, but also the workload services by cluster VIP. And the applications should be able to access the workload services by cluster VIPs.

Source	Destination	Port	Protocol	Description
Administrator IP	Control plane IP / VIP Workload plane VIP *	22 8443 443 80	TCP	SSH Web-UI HTTPS workload Optional HTTP workload
Application Server IP	Workload plane VIP	443 80	TCP	HTTPS workload Optional HTTP workload

Multi-Node Cluster with Load Balancer

When using a load balancer, the firewall should allow the administrator to access the management by cluster IP and/or VIP, but also the workload services by cluster VIP. The load balancer should be able to access the workload services by cluster VIPs. And the applications should be able to access the cluster services by the load balancer IP.

Source	Destination	Port	Protocol	Description
Administrator IP	Control plane IP / VIP Workload plane VIP *	22 8443 443 80 (Optional)	TCP	SSH Web-UI HTTPS workload Optional HTTP workload
Load Balancer IP	Workload plane IP	443 80	TCP	HTTPS workload Optional HTTP workload
Application Server IP	Load Balancer IP	443 80	TCP	HTTPS workload Optional HTTP workload