Agent ports

The Agent Ports page provides essential information about the communication ports used by Traceable's tracing and platform agents. This topic covers the default ports, reverse proxy configuration, and specific port requirements for different functionalities.

This topic details the ports required for communication between the Traceable Platform Agent (TPA) and other services. It also includes guidance on setting up HTTP and HTTPS reverse proxies to manage these connections.

Note

As of TPA version 1.44.0, OPA has been deprecated, and port 8181 is no longer required or used.

Reverse Proxy Configuration

HTTP Reverse Proxy

By default, the TPA exposes individual listeners for each service and port. However, you can configure a reverse proxy for HTTP or HTTPS traffic.

To configure an HTTP reverse proxy, enable it in the configuration as shown below:

# agentconfig.yaml
global:
  enable_http_reverse_proxy: true # false by default

This setting will expose port 5442 as an HTTP reverse proxy and handle all services except for ports 8443, 8444, and 5444.

HTTPS Reverse Proxy

For an HTTPS reverse proxy, update the TLS configuration:

# agentconfig.yaml
global:
  tls_server:
    endpoint: "0.0.0.0:5443"
    key_file: "../injector/pkg/injector/testdata/server.key"
    cert_file: "../injector/pkg/injector/testdata/server.crt"
    root_cert_file: "../injector/pkg/injector/testdata/rootCA.crt"

This configuration exposes port 5443 as an HTTPS reverse proxy, handling all services except ports 8443, 8444, and 5444.

Reverse Proxy Limitations

Both HTTP and HTTPS reverse proxies will work for most ports, except for:

• TCP 8443: Used by the F5 HSL listener.

• TCP 8444: Reserved for Apigee.

Required Ports

The following table lists the ports that need to be opened for communication between the tracing agent and the platform agent, along with the tracing agents that use each port:

Note

For DaemonSet Mirroring, no external ports need to be exposed. Mirroring to the Traceable Platform Agent (TPA) is conducted through a Unix domain socket, and the Go agent then exports data via the OTLP port.