Chapter 2. HTTPS gateway for standalone Red Hat Enterprise Linux deployments
On standalone Red Hat Enterprise Linux deployments, the HTTPS gateway is the public entry point for administrative and device traffic, consolidating TLS termination and path-based routing on port 443.
2.1. Role of the gateway
The gateway consolidates user-facing HTTPS traffic onto port 443 so that you can simplify firewall rules, certificate management, and monitoring.
The gateway:
- Terminates TLS for the web UI and for HTTP APIs that use JWT or session authentication.
-
Routes requests by URL path on
https://<baseDomain>/, using the same path layout as Red Hat OpenShift Container Platform Routes where practical. - Re-encrypts traffic to backend containers on the local Podman network.
-
Forwards TCP port
7443(agent API) and port4317(telemetry ingestion) with TLS passthrough so that mTLS and device certificates are validated by the backend services, not by nginx.
Backend services bind to the internal flightctl.network network. Only the gateway (and the passthrough ports above) need to be reachable from administrators, automation, and edge devices.
2.2. Path-based routing on port 443
Administrators and users connect to https://<baseDomain>/ on port 443. The gateway maps paths to services as follows:
| Path prefix | Backend service |
|---|---|
|
|
Web console ( |
|
|
User-facing API ( |
|
|
CLI download artifacts ( |
|
|
Alertmanager proxy ( |
|
|
Built-in PAM OpenID Connect (OIDC) issuer ( |
|
|
Operating system image build API ( |
The gateway also rewrites top-level API paths for convenience. Requests to /api/v1/… and /ws/v1/… on port 443 are routed to the user API as if they were sent under /_/flightctl/. You can run flightctl login https://<baseDomain> without specifying an API subpath.
2.3. Agent API and telemetry passthrough
The agent API and telemetry gateway use mutual TLS. The gateway does not terminate TLS for these listeners. It forwards TCP connections on the host ports that agents and collectors already use:
-
Port
7443— agent API (mTLS) -
Port
4317— telemetry gateway ingestion (when enabled)
Plan firewall rules so that enrolled devices can reach port 7443 on your management DNS name or IP address. For telemetry, open port 4317 only when sources outside the host must send data to the telemetry gateway.
2.4. Legacy ports after upgrade
Upgraded installations can keep serving the user API on port 3443 and the image build API on port 8445 through the gateway until you reconfigure clients. New installations should use port 443 only for those APIs.
When every client uses https://<baseDomain>/ on port 443, you can disable the legacy listeners in the gateway by setting gateway.suppressOldPorts to true in /etc/flightctl/service-config.yaml and restarting flightctl.target. See Migrating to the standalone HTTPS gateway in the Additional resources section.
2.5. Configuration overview
The /etc/flightctl/service-config.yaml file controls gateway behavior:
-
global.baseDomain— DNS name for the deployment (for example,edge.example.com). -
global.generateCertificates—builtin(default) to create a local CA and service certificates, ornonewhen you supply certificates under/etc/flightctl/pki/. -
gateway.suppressOldPorts— whentrue, the gateway stops exposing legacy API and image builder ports3443and8445on the base domain.
For DNS, certificates, migration steps, and port planning, see the Additional resources section.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}