Chapter 2. Configuring your firewall
If you use a firewall, you must configure it so that OpenShift Container Platform can access the sites that it requires to function. You must always grant access to some sites, and you grant access to more if you use Red Hat Insights, the Telemetry service, a cloud to host your cluster, and certain build strategies.
2.1. Configuring your firewall for OpenShift Container Platform
Before you install OpenShift Container Platform, you must configure your firewall to grant access to the sites that OpenShift Container Platform requires. When using a firewall, make additional configurations to the firewall so that OpenShift Container Platform can access the sites that it requires to function.
There are no special configuration considerations for services running on only controller nodes compared to worker nodes.
If your environment has a dedicated load balancer in front of your OpenShift Container Platform cluster, review the allowlists between your firewall and load balancer to prevent unwanted network restrictions to your cluster.
Procedure
Set the following registry URLs for your firewall’s allowlist:
URL Port Function registry.redhat.io
443
Provides core container images
access.redhat.com
443
Hosts a signature store that a container client requires for verifying images pulled from
registry.access.redhat.com
. In a firewall environment, ensure that this resource is on the allowlist.registry.access.redhat.com
443
Hosts all the container images that are stored on the Red Hat Ecosystem Catalog, including core container images.
quay.io
443
Provides core container images
cdn.quay.io
443
Provides core container images
cdn01.quay.io
443
Provides core container images
cdn02.quay.io
443
Provides core container images
cdn03.quay.io
443
Provides core container images
cdn04.quay.io
443
Provides core container images
cdn05.quay.io
443
Provides core container images
cdn06.quay.io
443
Provides core container images
sso.redhat.com
443
The
https://console.redhat.com
site uses authentication fromsso.redhat.com
-
You can use the wildcards
*.quay.io
and*.openshiftapps.com
instead ofcdn.quay.io
andcdn0[1-6].quay.io
in your allowlist. -
You can use the wildcard
*.access.redhat.com
to simplify the configuration and ensure that all subdomains, includingregistry.access.redhat.com
, are allowed. -
When you add a site, such as
quay.io
, to your allowlist, do not add a wildcard entry, such as*.quay.io
, to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, image downloads are denied when the initial download request redirects to a hostname such ascdn01.quay.io
.
-
You can use the wildcards
- Set your firewall’s allowlist to include any site that provides resources for a language or framework that your builds require.
If you do not disable Telemetry, you must grant access to the following URLs to access Red Hat Insights:
URL Port Function cert-api.access.redhat.com
443
Required for Telemetry
api.access.redhat.com
443
Required for Telemetry
infogw.api.openshift.com
443
Required for Telemetry
console.redhat.com
443
Required for Telemetry and for
insights-operator
If you use Alibaba Cloud, Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) to host your cluster, you must grant access to the URLs that offer the cloud provider API and DNS for that cloud:
Cloud URL Port Function Alibaba
*.aliyuncs.com
443
Required to access Alibaba Cloud services and resources. Review the Alibaba endpoints_config.go file to find the exact endpoints to allow for the regions that you use.
AWS
aws.amazon.com
443
Used to install and manage clusters in an AWS environment.
*.amazonaws.com
Alternatively, if you choose to not use a wildcard for AWS APIs, you must include the following URLs in your allowlist:
443
Required to access AWS services and resources. Review the AWS Service Endpoints in the AWS documentation to find the exact endpoints to allow for the regions that you use.
ec2.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
events.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
iam.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
route53.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
*.s3.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
*.s3.<aws_region>.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
*.s3.dualstack.<aws_region>.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
sts.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
sts.<aws_region>.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
tagging.us-east-1.amazonaws.com
443
Used to install and manage clusters in an AWS environment. This endpoint is always
us-east-1
, regardless of the region the cluster is deployed in.ec2.<aws_region>.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
elasticloadbalancing.<aws_region>.amazonaws.com
443
Used to install and manage clusters in an AWS environment.
servicequotas.<aws_region>.amazonaws.com
443
Required. Used to confirm quotas for deploying the service.
tagging.<aws_region>.amazonaws.com
443
Allows the assignment of metadata about AWS resources in the form of tags.
*.cloudfront.net
443
Used to provide access to CloudFront. If you use the AWS Security Token Service (STS) and the private S3 bucket, you must provide access to CloudFront.
GCP
*.googleapis.com
443
Required to access GCP services and resources. Review Cloud Endpoints in the GCP documentation to find the endpoints to allow for your APIs.
accounts.google.com
443
Required to access your GCP account.
Microsoft Azure
management.azure.com
443
Required to access Microsoft Azure services and resources. Review the Microsoft Azure REST API reference in the Microsoft Azure documentation to find the endpoints to allow for your APIs.
*.blob.core.windows.net
443
Required to download Ignition files.
login.microsoftonline.com
443
Required to access Microsoft Azure services and resources. Review the Azure REST API reference in the Microsoft Azure documentation to find the endpoints to allow for your APIs.
Allowlist the following URLs:
URL Port Function *.apps.<cluster_name>.<base_domain>
443
Required to access the default cluster routes unless you set an ingress wildcard during installation.
api.openshift.com
443
Required both for your cluster token and to check if updates are available for the cluster.
console.redhat.com
443
Required for your cluster token.
mirror.openshift.com
443
Required to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
quayio-production-s3.s3.amazonaws.com
443
Required to access Quay image content in AWS.
rhcos.mirror.openshift.com
443
Required to download Red Hat Enterprise Linux CoreOS (RHCOS) images.
sso.redhat.com
443
The
https://console.redhat.com
site uses authentication fromsso.redhat.com
storage.googleapis.com/openshift-release
443
A source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
Operators require route access to perform health checks. Specifically, the authentication and web console Operators connect to two routes to verify that the routes work. If you are the cluster administrator and do not want to allow
*.apps.<cluster_name>.<base_domain>
, then allow these routes:-
oauth-openshift.apps.<cluster_name>.<base_domain>
-
console-openshift-console.apps.<cluster_name>.<base_domain>
, or the hostname that is specified in thespec.route.hostname
field of theconsoles.operator/cluster
object if the field is not empty.
-
Allowlist the following URLs for optional third-party content:
URL Port Function registry.connect.redhat.com
443
Required for all third-party images and certified operators.
rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com
443
Provides access to container images hosted on
registry.connect.redhat.com
oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com
443
Required for Sonatype Nexus, F5 Big IP operators.
If you use a default Red Hat Network Time Protocol (NTP) server allow the following URLs:
-
1.rhel.pool.ntp.org
-
2.rhel.pool.ntp.org
-
3.rhel.pool.ntp.org
-
If you do not use a default Red Hat NTP server, verify the NTP server for your platform and allow it in your firewall.
Additional resources