We have firewalld configured (via salt, of course) to open all ports only to trusted networks (a mix of public IPs and private nets). A few ports like 80 and 443 are open to all IPs.
When k3s starts, traefik inserts a ton of KUBE* rules that are processed first which causes 8443 and 8080 to be open to all IPs. We don’t want that.
This seems to be a bug and there is no actual fix, any ideas would be appreciated. I have another posting with someone having a similar issue.
Installing k3s disables firewall port range unexpectedly - Help - NixOS Discourse