Port Reference

This document provides a comprehensive reference for all network ports required when self-hosting the ACTIVATE platform. Use this guide to configure firewalls, network security groups, and load balancers for your deployment.

Architecture Overview

The ACTIVATE platform uses a hub-and-spoke network model:

• The control plane runs in a central Kubernetes cluster and exposes a small set of external ports.
• Compute cluster agents (on cloud, managed, or existing clusters) establish outbound WebSocket connections to the control plane. No inbound ports need to be opened on compute clusters.
• All inter-service communication within the control plane cluster uses internal Kubernetes networking.

External Ports

These ports must be exposed on the control plane cluster's load balancer or ingress for the platform to function.

Port 443 (HTTPS)

This is the primary entry point for all platform traffic. A single port serves:

• Web interface: the ACTIVATE UI
• REST API: all platform API requests (/api/...)
• Agent tunnel connections: compute cluster agents connect via wss://<platform-host>/ws/ssh/tunnel using persistent multiplexed WebSocket connections
• SSH-over-WebSocket: browser-based terminal sessions to user workspaces
• SSE streams: real-time event delivery to the UI

TLS termination can be handled by the ACTIVATE ingress service itself (using the configured TLS secret) or by an external load balancer / reverse proxy.

Port 80 (HTTP)

Serves only as an HTTP-to-HTTPS redirect. Can be omitted if your load balancer handles redirection externally.

Port 8443 (CAC Authentication)

Required only for deployments using DoD CAC / smart card authentication. This port runs a separate TLS listener that requires mutual TLS (client certificate verification) against the DoD PKE certificate chain. If your deployment uses CAC authentication, TLS must be terminated by ACTIVATE. An external load balancer or reverse proxy cannot terminate TLS on this port, as the platform needs direct access to the client certificate. If your deployment does not use CAC authentication, this port does not need to be exposed.

Internal Cluster Ports

These ports are used for communication between services inside the control plane Kubernetes cluster. They should not be exposed externally. Kubernetes internal networking handles routing.

Databases

If using managed database services outside the cluster, ensure the control plane can reach the database endpoints on these ports. This may require VNet peering, private endpoints, or firewall rules on the database service.

Message Queue

Secrets Management

Platform Services

These are internal HTTP services that communicate behind the ingress. They do not need external exposure or special firewall rules. Kubernetes service discovery handles routing.

Compute Cluster Agent Connectivity

Compute cluster agents running on cloud clusters, managed clusters, or existing on-premises clusters communicate with the control plane over a single outbound connection. No inbound ports need to be opened on the compute cluster side.

Connection Architecture

How It Works

1. The agent on the compute cluster initiates an outbound WebSocket connection to wss://<platform-host>/ws/ssh/tunnel (port 443).
2. The connection is upgraded to a multiplexed session, allowing multiple logical streams over the single TCP connection.
3. The control plane can open new streams on this connection to reach the agent (effectively a reverse tunnel) without the agent needing any inbound ports.
4. The agent sends periodic heartbeats with resource metrics over the same HTTPS endpoint.

SSH Access to Clusters (Port 22)

User workspaces and the platform connect to compute clusters over SSH (port 22) for running jobs and interactive sessions. The pw ssh command intelligently selects the connection method based on network configuration:

• Direct (public IP): If the cluster node has a public IP, the platform connects directly to port 22.
• Direct (peered network): If the cluster's network is peered with the control plane network, the platform connects directly to the private IP on port 22.
• Via agent tunnel: If the cluster is in an isolated network (not peered), SSH traffic is routed through the agent's existing WebSocket tunnel. No additional ports need to be opened since port 22 is reached internally through the tunnel.

This means clusters should have port 22 open for SSH from the control plane, unless all SSH traffic is routed through the agent tunnel.

Cloud Clusters

Cloud clusters are provisioned by the platform through a configured cloud account (e.g., AWS, Azure, GCP). The platform provisions compute nodes in the cloud provider, and each node's agent automatically establishes a tunnel connection back to the control plane.

Network requirements from the cloud cluster:

Managed Clusters

Managed clusters are batch scheduler clusters (e.g., PBS, Slurm, LSF) registered with the platform. Node agents are installed using a one-time registration token and maintain a persistent tunnel connection to the control plane.

Network requirements from the managed cluster:

Existing Clusters (On-Premises)

Existing clusters are user-provided infrastructure that you register with the platform. They use the same outbound-only agent tunnel as cloud and managed clusters.

Network requirements from the existing cluster:

Cloud Cluster Internal Ports

Cloud clusters provisioned by the platform use additional ports for internal communication between the controller node and compute nodes. These ports do not need to be exposed to the control plane. They are used within the cluster's own network.

Shared Storage

Slurm Scheduler

General

User Workspace Ports

User workspaces can run on a dedicated user host, in a separate Kubernetes cluster, or in a dedicated namespace. The following ports are used by workspace containers and accessed by platform services.

These ports are internal and do not need external exposure.

Shared Storage (NFS)

If using NFS or a shared filesystem for platform storage (see Kubernetes Deployment Guide), the control plane services need access to the NFS endpoint.

Email (SMTP)

If the platform is configured to send email notifications (billing alerts, user invitations), the control plane needs outbound access to your SMTP server.

Summary

Minimum Required External Ports

For a standard deployment, only one port needs external exposure on the control plane:

Complete Port Reference