Does cri-o need access to firewall to add more rules?

[alpana17]

How to set firewall access to cri-o?

[haircommander]

I am pretty sure this would be a configuration for the firewall itself, unless you're asking about containers accessing outside of the firewall, in which case it would be a configuration on the CNI + firewall I think

[alpana17]

As in docker we can enable or disable docker daemon to make changes to iptables
dockerd --iptables=false

[alpana17]

Is there something similar in cri-o?

[haircommander]

this should be handled by CNI I think. Do you see CRI-O making changes to iptables?

[alpana17]

Till now, I have not seen any changes in my iptables list
It might be because, I just installed cri-o and started the service
I have not launched any containers with it