diff --git a/terraform/templates/cloud-init-k8s.tftpl b/terraform/templates/cloud-init-k8s.tftpl
index d51b8ae..4b385df 100644
--- a/terraform/templates/cloud-init-k8s.tftpl
+++ b/terraform/templates/cloud-init-k8s.tftpl
@@ -15,9 +15,10 @@ runcmd:
   - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
   - systemctl enable fail2ban
   - ufw allow OpenSSH
-  - ufw allow 16443 comment Kubernetes
+  - ufw allow 16443 comment "Kubernetes API endpoint"
   - ufw allow 80 comment HTTP
   - ufw allow 443 comment HTTPS
+  - ufw allow to ${node_ip} port 9100 comment "Metrics endpoint"
   - ufw enable
   - sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
   - sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config