<p>I'm following <a href="https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports" rel="nofollow noreferrer">this</a> and am about to ask our IT team to open the hardware firewall port for me:</p>
<p><strong>Control-plane node(s)</strong></p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Protocol</th>
<th>Direction</th>
<th>Port Range</th>
<th>Purpose</th>
<th>Used By</th>
</tr>
</thead>
<tbody>
<tr>
<td>TCP</td>
<td>Inbound</td>
<td>6443*</td>
<td>Kubernetes API server</td>
<td>All</td>
</tr>
<tr>
<td>TCP</td>
<td>Inbound</td>
<td>2379-2380</td>
<td>etcd server client API</td>
<td>kube-apiserver, etcd</td>
</tr>
<tr>
<td>TCP</td>
<td>Inbound</td>
<td>10250</td>
<td>kubelet API</td>
<td>Self, Control plane</td>
</tr>
<tr>
<td>TCP</td>
<td>Inbound</td>
<td>10251</td>
<td>kube-scheduler</td>
<td>Self</td>
</tr>
<tr>
<td>TCP</td>
<td>Inbound</td>
<td>10252</td>
<td>kube-controller-manager</td>
<td>Self</td>
</tr>
</tbody>
</table>
</div>
<p><strong>Worker node(s)</strong></p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Protocol</th>
<th>Direction</th>
<th>Port Range</th>
<th>Purpose</th>
<th>Used By</th>
</tr>
</thead>
<tbody>
<tr>
<td>TCP</td>
<td>Inbound</td>
<td>10250</td>
<td>kubelet API</td>
<td>Self, Control plane</td>
</tr>
<tr>
<td>TCP</td>
<td>Inbound</td>
<td>30000-32767</td>
<td>NodePort Services†</td>
<td>All</td>
</tr>
</tbody>
</table>
</div>
<p>Before I ask IT to open the hardware port for me, I checked my local environment which doesn't have a hardware firewall, and I see this:</p>
<pre><code># netstat -oanltp | grep 10250
tcp6       0      0 :::10250       :::*              LISTEN      3914/kubelet         off (0.00/0/0)
# netstat -oanltp | grep 10251
# netstat -oanltp | grep 10252
</code></pre>
<p>You can see that nothing is listening on <code>10251</code> and <code>10252</code>. But my <code>kube-scheduler</code> and <code>kube-controller-manager</code> are running, and everything looks OK:</p>
<pre><code>kube-system   kube-controller-manager-shlava     1/1     Running     0          47h     10.192.244.109   
kube-system   kube-scheduler-shlava              1/1     Running     0          47h     10.192.244.109   
</code></pre>
<p>So I wonder: is it normal that nothing is listening on <code>10251</code> and <code>10252</code>?</p>

<p>The answer is: <em>it depends</em>.</p>
<ul>
<li>You may have specified a different port for serving HTTP with <code>--port</code> flag</li>
<li>You may have disabled serving HTTP altogether with <code>--port 0</code></li>
<li>You are using latest version of K8s</li>
</ul>
<p>Last one is most probable as <a href="https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/" rel="noreferrer">Creating a cluster with kubeadm</a> states it is written for version <em>1.21</em></p>
<p>Ports <code>10251</code> and <code>10252</code> have been replaced in veresion <em>1.17</em> (see more <a href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.17.md#cluster-lifecycle-1" rel="noreferrer">here</a>)</p>
<blockquote>
<p>Kubeadm: enable the usage of the secure kube-scheduler and kube-controller-manager ports for health checks. For kube-scheduler was 10251, becomes 10259. For kube-controller-manager was 10252, becomes 10257.</p>
</blockquote>
<p>Moreover, this functionality is depracted in <em>1.19</em> (more <a href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#deprecation" rel="noreferrer">here</a>)</p>
<blockquote>
<p>Kube-apiserver: the componentstatus API is deprecated. This API provided status of etcd, kube-scheduler, and kube-controller-manager components, but only worked when those components were local to the API server, and when kube-scheduler and kube-controller-manager exposed unsecured health endpoints. Instead of this API, etcd health is included in the kube-apiserver health check and kube-scheduler/kube-controller-manager health checks can be made directly against those components' health endpoints.</p>
</blockquote>
<p>It seems some parts of documentation are outdated.</p>
