# CubeCMP networking requirements

> Understand the required network configurations to ensure a successful CubeCMP deployment.

## Overview for CubeCMP networking requirements {#overview-for-cubecmp-networking-requirements}

To enable communication between CubeCMP and the underlying CubeCOS cluster, you must open specific firewall ports. This allows CubeCMP to orchestrate resources and exchange cluster status information.

Configure firewall rules on the relevant network interfaces (such as management, data, or external networks) to allow inbound and outbound traffic as specified. Follow security best practices, such as least privilege access, and consult your network administrator for implementation details.

## Required ports for remote management {#required-ports-for-remote-management}

| Source                     | Destination       | Protocol | Port   | Description              |
| -------------------------- | ----------------- | -------- | ------ | ------------------------ |
| Operator client (Computer) | CubeCMP portal IP | TCP      | 80/443 | Management portal access |
| User client (Computer)     | CubeCMP portal IP | TCP      | 80/443 | User portal access       |

## Requires ports for CubeCOS to AppFramework management {#requires-ports-for-cubecos-to-appframework-management}

CubeCOS cluster communicates with the CubeCMP control plane and Etcd nodes to coordinate and exchange cluster status information. The following ports are required for successful operation and resource access:

| Source               | Destination         | Protocol | Port        | Description                                     |
| -------------------- | ------------------- | -------- | ----------- | ----------------------------------------------- |
| CubeCOS MGNT Network | Etcd Plane nodes    | TCP      | 2379        | Etcd plane node communication for management    |
| CubeCOS MGNT Network | Control Plane nodes | TCP      | 6443        | Control plane node communication for management |
| CubeCOS MGNT Network | CubeCMP portal IP   | TCP      | 30000-30001 | Image upload service during instalation         |

## Required ports for AppFramework and Kubernetes services {#required-ports-for-appframework-and-kubernetes-services}

CubeCMP communicates with the CubeCOS cluster to orchestrate and exchange information on cluster status. The following ports are required for successful operation and resource access:

| Source               | Destination                   | Protocol | Port        | Description                             |
| -------------------- | ----------------------------- | -------- | ----------- | --------------------------------------- |
| Any                  | Any                           | TCP/ UDP | 53          | DNS services                            |
| Any                  | Any                           | UDP      | 67          | DHCP services                           |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 2379        | Etcd plane nodes communication          |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 5000        | OpenStack service API                   |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 5010/ 9287  | Vulnerable services                     |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 6443        | Control plane nodes communication       |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 8003/ 8005  | Storage manager service                 |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 8774        | Compute service                         |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 8776        | Storage service                         |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 8777 / 8778 | Cluster coordination and service ports  |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 8888 / 8786 | File and object storage services        |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 9292        | Instance image service                  |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 9696        | Network service tarffic                 |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 9876        | Load balance API service                |
| Kubernetes Worker VM | CubeCOS MGNT VIP and node IPs | TCP      | 10443       | Container orchestration service traffic |

## Required ports for Kubernetes node external connectivity {#required-ports-for-kubernetes-node-external-connectivity}

Kubernetes nodes require internet access to communicate with external update and image repositories. The following table lists the required ports and protocols:

| Source           | Destination           | Protocol | Port | Purpose                               |
| ---------------- | --------------------- | -------- | ---- | ------------------------------------- |
| Kubernetes nodes | Metadata server       | TCP      | 80   | Metadata server access                |
| Kubernetes nodes | External repositories | TCP      | 443  | Container image and component updates |