Hubble Server & Hubble Relay (Cilium) ports open to the world in FW

[pschiffe]

Hello. I see that ports 4244-4245 are open to the world in FW.

Port 4245 is server, and in doc I see that you should port forward this port if you want to use it: https://docs.cilium.io/en/stable/gettingstarted/hubble_setup/#validate-hubble-api-access
It doesn't seem like it's necessary for this port to be open to the world.

Port 4244 is relay, and while it should be secured by mutual TLS, I don't see a reason for the port to be open to the world as well.

So what's the story behind the FW rule? Was there some problem if the traffic was enabled only between nodes?

[mysticaltech]

@pschiffe We were just trying to make sure Cilium works properly. If you have sure it works well and not needed, as described above, a PR to remove those is most welcome! 🙏

[M4t7e]

@pschiffe The ports have been removed in #896

[pschiffe]

awesome, thank you!