[Question] Is 127.0.0.1:6443 on RKE2 worker nodes suitable for k8sServiceHost in Cilium?

[aleskxyz]

Hi,

On RKE2 worker nodes, I see that rke2 listens on 127.0.0.1:6443, even though the node does not run any control-plane components:

tcp LISTEN 0 4096 127.0.0.1:6443 0.0.0.0:* users:(("rke2",pid=801,fd=7))

Is it supported and safe to use this local API endpoint (127.0.0.1:6443) for Cilium’s k8sServiceHost configuration, or should I always point Cilium to the real control-plane API server?

Thanks!

[brandond]

yes. agents (what you called workers) also run a client-side loadbalancer on port 6443 backed by all active control-plane servers. You can see this starting up if you look in the rke2-agent service logs.