Security-wise, is it OK, that flanneld is listening on the public interface udp port 8472?

Normally kubernetes nodes live in the cloud, hidden behind dozens of firewalls, they mostly operate in their local virtual network and only expose ports to the public, if administrator approves them manually.

But here I have a bare-metal server which is directly connected to the internet and I'm not sure if I should add firewall rules to block connections from the outside (default fw policy is ACCEPT).

For instance, I've configured etcd3 to listen for client connections on 127.0.0.1, furthermore clients must authenticate themselves with tls certificates. However flannel doesn't seem to have any authentication/authorization mechanism.

I understand that flanneld operates in the Transport Layer. Therefore it has information from the previous. So would it try drop any connection from the IPs, which are not in etcd?

For now my final intent is to create a single-node kubernetes “cluster”.