Network ports

This page lists the TCP and UDP ports that the GKE on AWS control plane and node pools use and their purpose.

Control plane ports

TCP or UDP Port Component or process Description
TCP 22 sshd SSH server
TCP 53 systemd-resolve DNS stub listener
UDP 53 systemd-resolve DNS stub listener
UDP 68 systemd-network DHCP client
TCP 10250 kubelet port
TCP 10255 kubelet readOnlyPort
TCP 10248 kubelet healthzPort
TCP 10251 kube-scheduler
TCP 10252 kube-scheduler
TCP 10257 kube-controller --secure-port
TCP 10259 kube-scheduler --secure-port
TCP 8132 proxy-server Konnectivity server (agent connection)
TCP 8133 proxy-server Konnectivity server (health)
TCP 8134 proxy-server Konnectivity server (admin/metrics)
TCP 11872 healthchecker Internal health checker for control plane
TCP 2381 etcd server-to-server communication
TCP 2380 etcd peer communication
TCP 4002 etcd client requests
TCP 2379 etcd client requests
TCP 21362 ais
TCP 29999 ais
TCP 29997 ais
TCP 443 kube-apiserver Kubernetes API server
TCP 22012 csi-attacher
TCP 22013 csi-resizer
TCP 22014 csi-snapshotter
TCP 22011 csi-provisioner
TCP 23011 snapshot-validation-webhook
TCP 8090 aws-encryption-provider
TCP 29001 gke-aws-controller-manager
TCP 8085 cluster-autoscaler Health check

Node pool ports

Port Component or process Description
TCP 22 sshd SSH server
TCP 53 systemd-resolve DNS stub listener
UDP 53 systemd-resolve DNS stub listener
UDP 68 systemd-network DHCP client
TCP 10250 kubelet port
TCP 10255 kubelet readOnlyPort
TCP 10248 kubelet healthzPort
TCP 9890 cilium cilium-agent gops server
TCP 9891 cilium operator gops server
TCP 4240 cilium cluster health checks
TCP 9876 cilium cilium-agent health status API
TCP 9990 cilium Prometheus metrics
TCP 9234 cilium /healthz
TCP 6942 cilium operator Prometheus metrics
UDP 6081 cilium cilium's Geneve tunneling