We are trying to migrate to cloud with AWS EKS hosted Tomcat server. Can we restrict the port range while invoking JDBC connection to DB as in current infrastructure only a certain range of port can be whitelisted in cloud firewall? also, will there be any performance impact if we restrict the port range?
Yes, but it’s important to distinguish between the database server port and the client-side (ephemeral) source ports used by the Tomcat pods.
You generally cannot configure JDBC or Tomcat to use a specific range of client-side ports.
The source port for an outbound JDBC connection is chosen by the Linux kernel running inside the EKS worker node, not by the JDBC driver or Tomcat.
Restricting the source port range is an operating system/network configuration, not a Pega or JDBC configuration.
In an AWS EKS environment:
Pods don’t normally control this.
It is configured on the worker node OS (or managed by the underlying AMI/managed node group).
Your Kubernetes or cloud platform team would need to determine whether changing it is supported and appropriate.
Performance impact -
If you reduce the ephemeral port range significantly, there can be consequences:
Increased risk of ephemeral port exhaustion.
New JDBC connections may fail if all ports are in use or in TIME_WAIT.
Higher connection latency under load.
Reduced scalbility for applications with many concurrent outbound connections.
Recommendations
For a Pega application on EKS:
- Do not attempt to configure JDBC source ports—this isn’t supported.
- Use the standard Pega/Tomcat JDBC connection pool.
- Configure AWS Security Groups or network policies to allow traffic to the database listener port.
- If a firewall insists on source port restrictions, involve the infrastructure/network team to evaluate configuring the Linux ephemeral port range and ensure it’s large enough to avoid exhaustion.
- Test under expected load if the range is narrowed to confirm there are no connection failures or throughput issues.