apiVersion: v1
kind: ConfigMap
metadata:
  name: iptables-rules
  namespace: kube-system
data:
  ipv4: |
    *filter
    # Block inbound traffic to the node by default
    # :INPUT DROP
    :KUBETABLES_CONTROLLER_INPUT -
    :DEFAULT_RULES -
    :KUBERNETES -

    -A KUBETABLES_CONTROLLER_INPUT -j KUBERNETES
    -A KUBERNETES -p tcp --dport 6443 -m set --match-set cali40all-hosts-net src -j ACCEPT -m comment --comment "Kubernetes API node access"
    -A KUBERNETES -p tcp --dport 6443 -m set --match-set cali40all-ipam-pools src -j ACCEPT -m comment --comment "Kubernetes API pod access"
    -A KUBERNETES -p tcp --dport 2379:2380 -m set --match-set cali40all-hosts-net src -j ACCEPT -m comment --comment "etcd cluster access"
    -A KUBERNETES -p tcp --dport 10250 -m set --match-set cali40all-hosts-net src -j ACCEPT -m comment --comment "Kubelet API"
    -A KUBERNETES -p tcp --dport 179 -m set --match-set cali40all-hosts-net src -j ACCEPT -m comment --comment "Calico BGP"
    -A KUBERNETES -p tcp --dport 30000:32767 -j ACCEPT -m comment --comment "Nodeports"

    -A KUBETABLES_CONTROLLER_INPUT -j DEFAULT_RULES
    -A DEFAULT_RULES -i lo -j ACCEPT
    -A DEFAULT_RULES -p udp -m udp --dport 33434:33534 -m limit --limit 3/sec --limit-burst 10 -j ACCEPT
    -A DEFAULT_RULES -p icmp -m limit --limit 3/sec --limit-burst 25 -j ACCEPT
    -A DEFAULT_RULES -m state --state RELATED,ESTABLISHED -j ACCEPT
    COMMIT

  ipv6: |
    *filter
    # Block inbound traffic to the node by default
    # :INPUT DROP
    :KUBETABLES_CONTROLLER_INPUT - [0:0]
    :DEFAULT_RULES - [0:0]

    -A KUBETABLES_CONTROLLER_INPUT -j DEFAULT_RULES
    -A DEFAULT_RULES -s ff00::/8 -j ACCEPT
    -A DEFAULT_RULES -s fe80::/10 -j ACCEPT
    -A DEFAULT_RULES -i lo -j ACCEPT
    -A DEFAULT_RULES -p udp -m udp --dport 33434:33534 -m limit --limit 3/sec --limit-burst 10 -j ACCEPT
    -A DEFAULT_RULES -p ipv6-icmp -m limit --limit 3/sec --limit-burst 25 -j ACCEPT
    -A DEFAULT_RULES -m state --state RELATED,ESTABLISHED -j ACCEPT
    COMMIT
