Port 6443 Kubernetes API – Free, Online, Private

What listens on 6443

The registry assigns 6443 to sun-sr-https, Service Registry Default HTTPS Domain, on TCP and UDP, from 2006. The process on this port in a Kubernetes cluster is kube-apiserver, speaking HTTPS. The convention is documented by the project and it is not an IANA reassignment. Clients authenticate with a client certificate or a bearer token. Anonymous access is a configuration. The API is not etcd. etcd is 2379 on the control plane. The kubelet is commonly 10250, which is not an IANA assignment and not this port. A load balancer in front of the API may present 443 and forward to 6443. Both numbers then matter, and only 6443 is the apiserver bind.

The IANA service name is sun-sr-https: Service Registry Default HTTPS Domain. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 6443. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 6443

Service notes for port 6443: the IANA name is sun-sr-https (Service Registry Default HTTPS Domain), and the program people mean is Kubernetes API. TCP 6443 is the IANA sun-sr-https port, Service Registry Default HTTPS. The Kubernetes API server uses 6443 by convention, and that is not the registered service. The API server is the cluster. A public 6443 with a weak anonymous policy, or with a client certificate checked into a repo, is a cluster admin on the internet. Keep the port on the control-plane network or behind a load balancer you intend to operate. Use short-lived tokens. Audit the anonymous and system:unauthenticated bindings. etcd's 2379 should not be reachable from workloads just because 6443 is. They are different decisions. A scanner will label this port sun-sr-https. The certificate and the process name are how you tell Kubernetes from an old Service Registry. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 6443, you are on the wrong page.

kubectl times out because the security group allows 6443 from the office and not from the CI network. The server is healthy. Another trap is a certificate for kubernetes.default.svc presented to a client that dialed a public name. TCP and TLS complete only if the name matches, and a name mismatch is not a closed port. Another is a control-plane rebuild that kept the etcd data and issued a new API certificate, so every kubeconfig breaks at once. Another is confusing 6443 with the dashboard or with 8443. Another is UDP. Nothing in Kubernetes speaks the API over UDP.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 6443 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. kube-apiserver should own TCP 6443. A TLS client should see the Kubernetes certificate. kubectl get --raw=/readyz from an allowed network is the health check. A TCP connect from a node that should not have the route is a policy bug.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• The IANA name is sun-sr-https. Kubernetes is convention, not the registry entry.
• 2379 is etcd. 10250 is the common kubelet port. Neither is 6443.
• UDP 6443 is in the registry and is not the API.
• A certificate name mismatch fails after the port is clearly open.

Linuxsudo ss -lptn 'sport = :6443'
sudo lsof -nP -iTCP:6443 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:6443 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.6443[^0-9]'

Windowsnetstat -ano | findstr :6443
Get-NetTCPConnection -LocalPort 6443

Remotenc -vz host 6443