The firewalld is for the trusted zone… and for the apiserver 6443 https port k3s comes with rbac enabled by default so if you want to access it via kubelet you

The firewalld is for the trusted zone… and for the apiserver 6443 https port k3s comes with rbac enabled by default so if you want to access it via kubelet you need to open it?! trusted zone is used by overlay networks or node internal stuff (or if you manually put your interface into it)