Understanding the connectivity requirements between components

[Palezvar]

We are thinking about giving dkron a shot in our topology. The kind of architecture we have in mind has 1) 3-node cluster for server side at location A behind a firewall 2) single node agent deployment at a few remote locations and each location is behind a separate firewall.

We setup a test environment with a single server and two agents (all in the same subnet) and it looks like even agents talk to each other constantly even when the datacenter attribute is set for different values. So we have a few questions:

• Do we need to allow ports TCP/UDP 8946 and TCP 6868 between all the components regardless of their role and location in the architecture? If the answer is yes, I was wondering why the agents from different locations need to talk to each other. If the answer is no, how is the system supposed to be configured in terms of tags and attributes to achieve what we want.
• Is all the traffic on all ports encrypted between components when SSL is enabled?

Thanks in advance.

[vcastellm]

Do we need to allow ports TCP/UDP 8946 and TCP 6868 between all the components regardless of their role and location in the architecture?

Yes, they talk to each other because of the clustering protocol, the cluster use gossip protocol to form the cluster.

Is all the traffic on all ports encrypted between components when SSL is enabled?

Gossip messages are encrypted using an encryption key see https://dkron.io/docs/cli/dkron_keygen
SSL Encryption for the rest of messages, gRPC, API, is only available in Dkron Pro.

Hope it helps