// Module included in the following assemblies:
//
// * hosted_control_planes/hcp-networking.adoc

:_mod-docs-content-type: REFERENCE
[id="hcp-ingress-reqs_{context}"]
= Ingress requirements for {hcp}

[role="_abstract"]
Ingress ports involve incoming traffic to {hcp}. Ensure the correct ports are open for communication between the management cluster, the {hcp} components, and the compute nodes.

The following table details the ports for incoming traffic to {hcp} across all platforms:

.Common ingress ports
[cols="5",options="header"]
|===

|Port |Protocol |Service |Description |Code reference

|`6443`
|TCP
|Kubernetes API server
|Primary API server port for `kubectl` and cluster communication
|`support/config/constants.go:35` - `KASSVCPort = 6443`

|`9090`
|TCP
|Ignition server
|Port from compute nodes during the bootstrap process, `NodePort` or `Route` service publishing strategy
|-

|===

The service publishing strategy determines additional ports. The `Ignition Proxy` and `Konnectivity` services are exposed through one of the following service publishing strategies:

`Route`:: This setting is the default on {product-title}. Traffic flows through the OpenShift router on port 443. No additional firewall rules are needed beyond standard HTTPS.
`NodePort`:: Direct access is required to port 8091 (Konnectivity) and port 8443 (Ignition Proxy).
`LoadBalancer`:: Direct access is required to port 8091 (Konnectivity) through the cloud load balancer.

The following table details the ingress port configurations that are specific to each platform:

.Platform-specific ingress port configurations
[cols="5",options="header"]
|===

|Platform |Port |Service |Description |Code reference

|Agent
|`8443`
|Ignition Proxy
|HTTPS proxy for ignition content delivery (`NodePort` publishing)
|`hypershift-operator/controllers/hostedcluster/network_policies.go:390`

|Agent
|`8081`
|Agent CAPI health probe
|Health check endpoint for Agent platform CAPI provider
|`hypershift-operator/controllers/hostedcluster/internal/platform/agent.go:96,105,115`

|Agent
|`8080`
|Agent CAPI metrics
|Metrics endpoint for Agent platform CAPI provider (binds to localhost only)
|`hypershift-operator/controllers/hostedcluster/internal/platform/agent/agent.go:97`

|{aws-short}
|`9440`
|CAPI health check
|Health and readiness probe endpoint for {aws-short} CAPI provider
|`hypershift-operator/controllers/hostedcluster/internal/platform/aws/aws.go:222-223`

|Bare metal without the Agent platform
|`8443`
|Ignition Proxy
|HTTPS proxy for ignition content delivery (`NodePort` publishing)
|-

|KubeVirt
|`9440`
|CAPI health check
|Health and readiness probe endpoint
|`hypershift-operator/controllers/hostedcluster/internal/platform/kubevirt/kubevirt.go:140`

|{rh-openstack} (Technology Preview)
|`9440`
|CAPI health check
|Health and readiness probe endpoint
|`hypershift-operator/controllers/hostedcluster/internal/platform/openstack/openstack.go:238`

|{rh-openstack} (Technology Preview)
|`8081`
|ORC health check
|Health and readiness probe endpoint for OpenStack Resource Controller
|`hypershift-operator/controllers/hostedcluster/internal/platform/openstack/openstack.go:294,311`

|===

The following table details the ingress port configurations for private clusters, such as those on {aws-short}:

.Ingress port configurations for private clusters
[cols="4",options="header"]
|===

|Port |Service |Description |Code reference

|`8080`
|Private router HTTP
|HTTP traffic through the private router
|`hypershift-operator/controllers/hostedcluster/network_policies.go:244`

|`8443`
|Private router HTTPS
|HTTPS traffic through the private router
|`hypershift-operator/controllers/hostedcluster/network_policies.go:245`

|===
