Ports and Services#

Audience: Operations Administrators
Prerequisites: Network knowledge
Outcome: Understand ports and services used by Kleidia

External Ports#

HTTP/HTTPS#

  • Port 443: HTTPS (web interface and API via external load balancer)

Kubernetes Services#

Backend Service#

  • Type: NodePort
  • Port: 32570 (configurable)
  • Protocol: HTTP
  • Access: Via external load balancer (port 443)

Frontend Service#

  • Type: NodePort
  • Port: 30805 (configurable)
  • Protocol: HTTP
  • Access: Via external load balancer (port 443)

PostgreSQL Service#

  • Type: ClusterIP (internal only)
  • Port: 5432
  • Protocol: PostgreSQL
  • Access: Internal Kubernetes only

OpenBao (Vault) Service#

  • Type: ClusterIP (internal only)
  • Port: 8200
  • Protocol: HTTP
  • Access: Internal Kubernetes only

Agent Ports#

Local Agent#

  • Port: 56123 (configurable)
  • Protocol: HTTP
  • Access: localhost only (127.0.0.1)
  • ⚠️ CRITICAL: Never exposed externally

Service Endpoints#

Backend API Endpoints#

  • /api/health - Health check
  • /api/auth/login - User login
  • /api/auth/logout - User logout
  • /api/yubikey - YubiKey management
  • /api/admin/* - Admin operations

Frontend Endpoints#

  • / - Web interface
  • /dashboard - User dashboard
  • /dashboard/admin - Admin panel
  • /login - Login page

Agent Endpoints#

  • /.well-known/kleidia-agent - Agent discovery
  • /health - Health check
  • /pubkey - Public key endpoint
  • /piv/* - YubiKey operations

Network Architecture#

External Access#

Internet
External Load Balancer (Port 443)
  ├── Frontend (NodePort 30805)
  └── Backend (NodePort 32570)

Internal Communication#

Backend
  ├── PostgreSQL (Port 5432, ClusterIP)
  └── OpenBao (Port 8200, ClusterIP)

Agent Communication#

Browser (Frontend)
  └── Agent (localhost:56123, HTTP)

Firewall Configuration#

Inbound Rules (Server)#

  • Port 443: Allow (for HTTPS)

Agent Workstations#

  • No Inbound Ports: Agents use localhost only
  • Outbound HTTPS: Allow

Security Considerations#

  • ✅ Use firewall to restrict access
  • ✅ Only expose necessary ports
  • ✅ Use internal services for database and Vault
  • ✅ Never expose agent ports externally
  • ✅ Use HTTPS for all external communication