Node Requirements

Supported Configurations

Running the control plane as a binary with vCluster Standalone. When scaling with additional worker nodes, they are joined as private nodes.

Control plane node requirements

• Network connectivity between any control plane and worker nodes being used for the cluster. See Required ports.

Required ports

Open these inbound ports in any firewall or security group that controls network access between your machines.

Port	Protocol	Open on	Source	Purpose
8443	TCP	Control plane nodes	Workstations, worker nodes, other control plane nodes	Cluster API, node join, and the Konnectivity tunnel to worker nodes
2379-2380	TCP	Control plane nodes	Other control plane nodes	Embedded etcd client and peer traffic. Required only for high availability.
8472	UDP	All nodes that run workloads	All nodes that run workloads	Flannel VXLAN pod network, the default CNI. Not required if you replace Flannel.

The vCluster proxy serves the cluster API on port 8443, and you can't change this port. The Kubernetes API server only listens on 127.0.0.1:6443, so port 6443 isn't reachable from other machines and doesn't need to be opened.

With Konnectivity enabled (the default), the control plane reaches the kubelet on worker nodes through the Konnectivity tunnel over port 8443, so port 10250 doesn't need to be open. If you disable Konnectivity, open port 10250/TCP on worker nodes to traffic from control plane nodes.

Host requirements

• Linux distribution with systemd support (required for service management)
• iptables binaries installed (automatically available on Ubuntu, may need manual installation on other distributions)
• curl installed
• Root user access
• Increased inotify watchers on each node. fs.inotify resource limits (defined by fs.inotify.max_user_watches and fs.inotify.max_user_instances system variables. For example, in Ubuntu these default to 8192 and 128 respectively, which is not enough.)

info

On RHEL 8 and 9, SELinux in enforcing mode is supported with the vcluster-selinux RPM. install-standalone.sh installs it automatically; no extra steps are required. See SELinux support.

Increase the inotify watchers limit

Log into each node and manually increase the watchers limit.

1. Log into the Node. Use SSH or your preferred method for node access.

2. Confirm the current inotify watchers limit by running:

   cat /proc/sys/fs/inotify/max_user_watches

3. Increase the limit temporarily.

   sudo sysctl fs.inotify.max_user_watches=524288

   Adjust the value as needed; 524288 is typically sufficient.

4. Increase the limit permanently.

   To make the change persistent across reboots, add it to the sysctl configuration:

   echo "fs.inotify.max_user_watches=524288" | sudo tee -a /etc/sysctl.conf
   sudo sysctl -p

Supported operating systems

OS	Version	Additional Instructions
Ubuntu	24.04
Ubuntu	22.04
RHEL (Red Hat Enterprise Linux)	9	Install vcluster-selinux or disable SELinux
RHEL (Red Hat Enterprise Linux)	8	Install vcluster-selinux and pin Kubernetes to 1.31, or disable SELinux
RHEL (Red Hat Enterprise Linux)	10	Disable SELinux
CentOS Stream	9	Disable SELinux and install iptables
Rocky	10	Disable SELinux and install iptables
Rocky	9	Disable SELinux and install iptables

CentOS Stream and Rocky support

Install iptables

yum install iptables-services
systemctl enable iptables
systemctl start iptables