Why is the port 6443 required in the boostrap machine to deploy Tanzu Kubernetes Grid on vSphere environment?

During the deployment of a Tanzu Kubernetes Grid (TKG) management cluster, the bootstrap machine needs to communicate with the control plane of the new cluster it is creating. The central component of the Kubernetes control plane is the API server, which exposes the Kubernetes API. By default, the Kubernetes API server listens for secure HTTPS traffic on TCP port 6443. The bootstrap machine uses this port to send instructions and configurations to build and validate the management cluster on the vSphere environment.

A. Kubernetes IP is exposed: An IP address is a network identifier, not a service. A port is used to expose a service running at an IP address; the term "IP is exposed" is imprecise.
C. Kubernetes TLS is exposed: TLS is the encryption protocol used to secure the connection to the API server. The port exposes the API service itself, not the security protocol.
D. Kubernetes VPN is exposed: Kubernetes does not have a native VPN service that operates on port 6443. This port is the standard, well-known port for the Kubernetes API server.

1. VMware Tanzu Kubernetes Grid Documentation: In the section detailing firewall requirements

it explicitly states that port 6443 is for the "Kubernetes API server." This is required for the bootstrap machine to communicate with the control plane nodes of the cluster being deployed.

Source: VMware Tanzu Kubernetes Grid 2.1 Documentation

"Required Ports and Protocols for TKG on vSphere with a Supervisor".

Reference: The table "Firewall Rules for TKG on vSphere with a Supervisor" lists Source: "Bootstrap machine"

Destination: "Supervisor Control Plane VMs"

Protocol/Port: "TCP 6443"

and Purpose: "Kubernetes API".

2. Official Kubernetes Documentation: The core Kubernetes documentation confirms the role and default port of the API server (kube-apiserver)

which is the component that runs on port 6443.

Source: Kubernetes Documentation

"Components of Kubernetes".

Reference: In the section describing the kube-apiserver

it is identified as the component that "exposes the Kubernetes API" and is the "front end for the Kubernetes control plane." The documentation on "Controlling Access to the Kubernetes API" also consistently refers to port 6443 as the secure port for the API server.