TCP and UDP ports for firewall rules.

[madden1706]

I have been playing around using Linode's k8s offering and using cert-manager. With no firewall rules I can get a cert fine - this works. I've been struggling with the firewall rules (failing to call the webhook) that are needed for cert manager, are there any specific ports needed (I am using webhook.securePort=10260 with the corresponding firewall rule plus the firewall rules needed for Linodes k8s offering)?

The below is the error message I get:

$ k cert-manager check api

Not ready: Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": context deadline exceeded

[madden1706]

Thus far I seem to need to have a rule to allow all (I haven't narrowed this down further) UDP ports for all IPv4 along with the necessary core k8s rules and 10260 TCP rule I have in place.

[rombert]

FWIW I am allowing all TCP and UDP traffic to "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", which should IMO be safe.

[wallrj]

For anyone still encountering the "context deadline exceeded" error from the webhook, please do the following:

• Increase the ValidatingWebhookConfiguration and MutatingWebhookConfiguration timeout to its maximum value of 30 seconds, so that the underlying cause of the error is revealed. In cert-manager 1.14 this will become the default value. See Increase the default webhook timeout to its maximum value of 30 seconds #6488
• Read https://cert-manager.io/docs/troubleshooting/webhook/#error-context-deadline-exceeded
• Read https://cert-manager.io/docs/installation/best-practice/#network-requirements-and-network-policy