Ports and Network Flows

Plan Management and appliance access separately. Management’s public hostname, appliance application hostname, cluster API endpoint, and individual node addresses identify different destinations.

Operator and Integration Access

Source	Destination	Protocol / port	Purpose and applicability
Operator browser	Management public hostname	TCP / configured HTTPS port, default 443	Management, authentication, downloads, and operator tools exposed through Management.
Browser or ACME certificate authority	Management host	TCP / 80	Published HTTP listener. ACME HTTP-01 validation requires the CA to reach it.
Host administrator	Management host	TCP / 22	SSH host administration. Separate from Management browser authentication.
Management	Appliance nodes	TCP / 50000	Authenticated Talos API used by installation, Operations and firewall changes. It remains reachable between cluster access leases.
Management	Appliance node IPs	TCP / 6443	Authenticated Kubernetes access for operations, health and tools. External access is opened for the cluster access lease.
Management Operations	Appliance node registries	TCP / 443	Authenticated artifact publication and reads. External access remains open for the cluster access lease, rather than opening separately for each operation.
Management	Configured release registries	TCP / endpoint port	Retrieve release or update bundles. HTTPS commonly uses 443; use the configured registry endpoint. For offline use, upload the bundle through the browser.
Customer monitoring	Appliance customer metrics listener	TCP / 9443	Optional HTTPS metrics interface; closed when metrics access is disabled.
Appliance	Configured Syslog destination	Configured TCP or UDP port	Optional log forwarding. Initial settings use TCP 6514 with TLS; use the receiver’s agreed settings.
Appliance	Configured S3 backup endpoint	TCP / endpoint port	Optional publication of full backups. Use the endpoint’s configured scheme and port.
Appliance	Configured SFTP backup server	TCP / configured port, default 22	Optional publication of full backups using SSH key authentication.

Source

Destination

Protocol / port

Purpose and applicability

Operator browser

Management public hostname

TCP / configured HTTPS port, default 443

Management, authentication, downloads, and operator tools exposed through Management.

Browser or ACME certificate authority

Management host

TCP / 80

Published HTTP listener. ACME HTTP-01 validation requires the CA to reach it.

Host administrator

Management host

TCP / 22

SSH host administration. Separate from Management browser authentication.

Management

Appliance nodes

TCP / 50000

Authenticated Talos API used by installation, Operations and firewall changes. It remains reachable between cluster access leases.

Management

Appliance node IPs

TCP / 6443

Authenticated Kubernetes access for operations, health and tools. External access is opened for the cluster access lease.

Management Operations

Appliance node registries

TCP / 443

Authenticated artifact publication and reads. External access remains open for the cluster access lease, rather than opening separately for each operation.

Management

Configured release registries

TCP / endpoint port

Retrieve release or update bundles. HTTPS commonly uses 443; use the configured registry endpoint. For offline use, upload the bundle through the browser.

Customer monitoring

Appliance customer metrics listener

TCP / 9443

Optional HTTPS metrics interface; closed when metrics access is disabled.

Appliance

Configured Syslog destination

Configured TCP or UDP port

Optional log forwarding. Initial settings use TCP 6514 with TLS; use the receiver’s agreed settings.

Appliance

Configured S3 backup endpoint

TCP / endpoint port

Optional publication of full backups. Use the endpoint’s configured scheme and port.

Appliance

Configured SFTP backup server

TCP / configured port, default 22

Optional publication of full backups using SSH key authentication.

The node-registry listener on TCP 443 is an artifact endpoint. Do not confuse it with the Management HTTPS listener or an ERS application endpoint.

Access Lifetime and Network Restrictions

A valid artifact bundle opens external Kubernetes and registry access for a six-hour lease. Expiry, explicit eviction and normal Management shutdown attempt to close those external paths while preserving cluster-internal traffic. After a crash or loss of node connectivity, Management may be unable to confirm that remote access is closed. Reconnect to reconcile access and follow the displayed warning.

The lease does not create a Management source-IP allowlist. While open, these authenticated endpoints can be reached from routable IPv4 sources permitted by your surrounding network. Restrict those sources through your own network controls. See Renew or end cluster access and Security and hardening.

Network Services and ERS Dependencies

Management and appliance nodes need the DNS and time services selected during installation. Management startup waits for its configured network and time synchronization. Allow the actual DNS resolver and NTP destination specified in the deployment plan.

ERS client interfaces, HSM connections, identity providers, and external certificate services depend on the configured product interfaces and vendor endpoints. Use the matching ERS product manual and HSM vendor requirements for those flows; record the selected ports in the deployment plan. See external monitoring and backup destinations for optional integrations.

Scope of this Table

This table covers Management access and customer integrations. It is not a complete node-to-node firewall allowlist. The appliance also needs internal cluster, storage, database, and workload communication. Use the deployment network requirements agreed for the release before adding filtering between appliance nodes. Do not expose cluster-internal service ports to client networks merely because a workload uses them.