What uses port 6443
kubectl, controllers and kubelets talk to the cluster through the API server on 6443 (managed services like EKS, GKE and AKS expose it on 443). Every request is authenticated and authorized, but the API server is still a high-value target, so restrict which networks can reach it.
Should port 6443 be open to the internet?
Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.
-
The connection to the server localhost:8080 was refusedmeans kubectl has no kubeconfig. SetKUBECONFIGor copy/etc/kubernetes/admin.confto~/.kube/config.
Check what is listening on port 6443
sudo ss -ltnp 'sport = :6443'sudo lsof -nP -iTCP:6443 -sTCP:LISTENGet-NetTCPConnection -LocalPort 6443 -State Listen
netstat -ano | findstr :6443No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 6443
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:6443 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 6443 -State Listen).OwningProcessAllow port 6443 from trusted networks only
The examples allow 6443 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 6443 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 6443 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="6443" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "Kubernetes API server 6443/TCP" -Direction Inbound -Protocol TCP -LocalPort 6443 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 6443 from another machine
nc -zv example.com 6443Test-NetConnection example.com -Port 6443Related ports
- Port 10250 (Kubelet API): the kubelet API on every Kubernetes node.
- Port 2379 (etcd client): the etcd client API port, used by the Kubernetes API server.
- Port 443 (HTTPS): the default port for HTTPS, encrypted web traffic.
- Port 2376 (Docker API (TLS)): the Docker daemon API secured with TLS.
More containers and orchestration ports
2375 (Docker API (unencrypted)) , 2380 (etcd peer) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 6443 used for?
Port 6443 is the default port of the Kubernetes API server. kubectl, controllers and kubelets talk to the cluster through the API server on 6443 (managed services like EKS, GKE and AKS expose it on 443). Every request is authenticated and authorized, but the API server is still a high-value target, so restrict which networks can reach it.
Is it safe to open port 6443?
Only open this port to known networks or users, for example your office IP, a VPN or behind authentication. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 6443 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :6443'" on Linux or "sudo lsof -nP -i :6443" on macOS. From another machine, run "nc -zv host 6443" or, on Windows, "Test-NetConnection host -Port 6443". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.