Changing default ports

[everydaylearner]

Changing default ports

[kurokobo]

@everydaylearner
Hi, thanks for using my guide :)

Where can i change the port number? say i want to run on port 8443 rather than default port 80?

You mean, your AWX is already accesible via HTTP over 80 and HTTPS over 443, but you want to use HTTPS over 8443 instead, right?

[everydaylearner]

yes correct, i want to run over 8443

Thank you!

[kurokobo]

Okay, so you should to know the port 8443 on your K3s host is already used by Traefik by default, to route HTTPS traffic internally.

$ kubectl -n kube-system get deployment traefik -o=jsonpath='{.spec.template.spec.containers[0].ports}' | jq
...
  {
    "containerPort": 8443,
    "hostPort": 8443,     👈👈👈
    "name": "websecure",
    "protocol": "TCP"
  }
...

Traefik has the feature called EntryPoints to expose custom ports, but 8443 can't be used due to this confliction.

So, there are two way to achieve your requirements.

1. Expose 8443 that Traefik uses internally to the host network.
2. Change internal port for Traefik from 8443, and then create custom EntryPoints.

The method 1 is a bit dirty and un-secure since unintended ports such as 8000, 9000, 9100 will also be exposed, but simple.

# Create custom configuration file for Traefik
sudo tee /var/lib/rancher/k3s/server/manifests/traefik-config.yaml <<EOF
---
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    hostNetwork: true
EOF

# Then wait until your traefik by the following command is 1/1 READY.
kubectl -n kube-system get deployment traefik

Now your 8443 is accessible via HTTPS

Method 2 is a bit complicated and there might be some side effects.

# Create custom configuration file for Traefik
sudo tee /var/lib/rancher/k3s/server/manifests/traefik-config.yaml <<EOF
---
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    ports:
      websecure:
        port: 8442
        expose: true
        exposedPort: 443
        protocol: TCP
        tls:
          enabled: true
      mywebsecure:
        port: 8443
        expose: true
        exposedPort: 8443
        protocol: TCP
        tls:
          enabled: true
    entryPoints:
      mywebsecure:
        address: ":8443"
EOF

# Then wait until your traefik by the following command is 1/1 READY.
kubectl -n kube-system get deployment traefik

[everydaylearner]

thank you very much! Appreciate it! It helps to understand better. I think i need to read more on traefik.