Network And Ports

This page lists default service ports and network access requirements. Production environments should narrow access based on gateways, Ingress, firewalls, and NetworkPolicies.

Default Services

Component	Service	Default Type	Port	Notes
disaster-web	disaster-web	NodePort	80 -> 30087	Console entry
disaster-server	disaster-server	ClusterIP	30081	REST API, Watch API, auth, statistics
webhook	disaster-operator-webhook-service	ClusterIP	443 -> 9443	CRD admission webhook
operator metrics	disaster-operator-controller-manager-metrics-service	ClusterIP	8443	controller-runtime metrics protected by RBAC

Management Cluster Egress

Operator and Server need access to:

• Source cluster Kubernetes API.
• Target cluster Kubernetes API.
• Object storage endpoint.
• Image registry.
• cert-manager APIs when cert-manager is used.

Business Cluster Egress

Participating clusters need access to:

• Object storage endpoint.
• Image registry.
• Cloud or storage APIs required by Velero plugins.

Exposure Guidance

• Expose disaster-web through Ingress, a gateway, or a dedicated operations entry point.
• Do not expose disaster-server directly through NodePort or LoadBalancer unless it is explicitly controlled.
• Keep /openapi.yaml, /openapi.json, and /swagger/ in a controlled network when enabled in production.
• Watch routes need gateway support for long-lived or streaming connections.

NetworkPolicy Guidance

If NetworkPolicy is enabled:

• Allow only disaster-web or the gateway to access disaster-server:30081.
• Allow only the Kubernetes API server to access the webhook service.
• Allow only monitoring namespaces to access the operator metrics service.
• Allow operator/server egress to remote Kubernetes APIs and object storage endpoints.

Verification

kubectl -n disaster-system get svc
kubectl -n disaster-system get endpoints
kubectl -n disaster-system port-forward svc/disaster-web 8087:80
curl -I http://127.0.0.1:8087