You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/openshift/howto-restrict-egress.md
+17-16Lines changed: 17 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,11 +5,11 @@ author: joharder
5
5
ms.author: joharder
6
6
ms.service: azure-redhat-openshift
7
7
ms.topic: article
8
-
ms.date: 12/15/2022
8
+
ms.date: 02/16/2023
9
9
---
10
10
# Control egress traffic for your Azure Red Hat OpenShift (ARO) cluster
11
11
12
-
This article provides the necessary details that allow you to secure outbound traffic from your Azure Red Hat OpenShift cluster (ARO). With the release of the [Egress Lockdown Feature](./concepts-egress-lockdown.md), all of the required connections for a private cluster will be proxied through the service. There are additional destinations that you may want to allow to use features such as Operator Hub, or Red Hat telemetry. An [example](#private-aro-cluster-setup)will be provided at the end on how to configure these requirements with Azure Firewall. Keep in mind, you can apply this information to Azure Firewall or to any outbound restriction method or appliance.
12
+
This article provides the necessary details that allow you to secure outbound traffic from your Azure Red Hat OpenShift cluster (ARO). With the release of the [Egress Lockdown Feature](./concepts-egress-lockdown.md), all of the required connections for a private cluster are proxied through the service. There are additional destinations that you may want to allow to use features such as Operator Hub, or Red Hat telemetry. An [example](#private-aro-cluster-setup)is be provided at the end showing how to configure these requirements with Azure Firewall. Keep in mind, you can apply this information to Azure Firewall or to any outbound restriction method or appliance.
13
13
14
14
## Before you begin
15
15
@@ -19,19 +19,19 @@ This article assumes that you're creating a new cluster. If you need a basic ARO
19
19
20
20
This list is based on the list of FQDNs found in the OpenShift docs here: https://docs.openshift.com/container-platform/latest/installing/install_config/configuring-firewall.html
21
21
22
-
The following FQDNs are proxied through the service, and will not need additional firewall rules. They are here for informational purposes.
22
+
The following FQDNs are proxied through the service, and won't need additional firewall rules. They're here for informational purposes.
23
23
24
24
| Destination FQDN | Port | Use |
25
25
| ----------- | ----------- | ------------- |
26
-
|**`arosvc.azurecr.io`**|**HTTPS:443**| Global Internal Private registry for ARO Operators. Required if you do not allow the service-endpoints Microsoft.ContainerRegistry on your subnets. |
27
-
|**`arosvc.$REGION.data.azurecr.io`**|**HTTPS:443**| Regional Internal Private registry for ARO Operators. Required if you do not allow the service-endpoints Microsoft.ContainerRegistry on your subnets. |
28
-
|**`management.azure.com`**|**HTTPS:443**|This is used by the cluster to access Azure APIs. |
29
-
|**`login.microsoftonline.com`**|**HTTPS:443**|This is used by the cluster for authentication to Azure. |
30
-
|**`*.monitor.core.windows.net`**|**HTTPS:443**|This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
31
-
|**`*.monitoring.core.windows.net`**|**HTTPS:443**|This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
32
-
|**`*.blob.core.windows.net`**|**HTTPS:443**|This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
33
-
|**`*.servicebus.windows.net`**|**HTTPS:443**|This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
34
-
|**`*.table.core.windows.net`**|**HTTPS:443**|This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
26
+
|**`arosvc.azurecr.io`**|**HTTPS:443**| Global Internal Private registry for ARO Operators. Required if you don't allow the service-endpoints Microsoft.ContainerRegistry on your subnets. |
27
+
|**`arosvc.$REGION.data.azurecr.io`**|**HTTPS:443**| Regional Internal Private registry for ARO Operators. Required if you don't allow the service-endpoints Microsoft.ContainerRegistry on your subnets. |
28
+
|**`management.azure.com`**|**HTTPS:443**|Used by the cluster to access Azure APIs. |
29
+
|**`login.microsoftonline.com`**|**HTTPS:443**|Used by the cluster for authentication to Azure. |
30
+
|**`*.monitor.core.windows.net`**|**HTTPS:443**|Used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
31
+
|**`*.monitoring.core.windows.net`**|**HTTPS:443**|Used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
32
+
|**`*.blob.core.windows.net`**|**HTTPS:443**|Used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
33
+
|**`*.servicebus.windows.net`**|**HTTPS:443**|Used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
34
+
|**`*.table.core.windows.net`**|**HTTPS:443**|Used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
35
35
36
36
> [!NOTE]
37
37
> For many customers exposing *.blob, *.table and other large address spaces creates a potential data exfiltration concern. You may want to consider using the [OpenShift Egress Firewall](https://docs.openshift.com/container-platform/latest/networking/openshift_sdn/configuring-egress-firewall.html) to protect applications deployed in the cluster from reaching these destinations and use Azure Private Link for specific application needs.
@@ -43,13 +43,13 @@ The following FQDNs are proxied through the service, and will not need additiona
43
43
### ADDITIONAL CONTAINER IMAGES
44
44
45
45
-**`registry.redhat.io`**: Used to provide images for things such as Operator Hub.
46
-
-**`*.quay.io`**: May be used to download images from the Red Hat managed Quay registry. Also a possible fall-back target for ARO required system images. If your firewall cannot use wildcards, you can find the [full list of subdomains in the Red Hat documentation.](https://docs.openshift.com/container-platform/latest/installing/install_config/configuring-firewall.html)
46
+
-**`*.quay.io`**: May be used to download images from the Red Hat managed Quay registry. Also a possible fall-back target for ARO required system images. If your firewall can't use wildcards, you can find the [full list of subdomains in the Red Hat documentation.](https://docs.openshift.com/container-platform/latest/installing/install_config/configuring-firewall.html)
47
47
48
48
---
49
49
50
50
### TELEMETRY
51
51
52
-
All this section can be opted out, but before we know how, please check what it is: https://docs.openshift.com/container-platform/4.6/support/remote_health_monitoring/about-remote-health-monitoring.html
52
+
You can opt out of telemetry, but make sure you understand this feature before doing so: https://docs.openshift.com/container-platform/4.6/support/remote_health_monitoring/about-remote-health-monitoring.html
53
53
-**`cert-api.access.redhat.com`**: Used for Red Hat telemetry.
54
54
-**`api.access.redhat.com`**: Used for Red Hat telemetry.
55
55
-**`infogw.api.openshift.com`**: Used for Red Hat telemetry.
@@ -64,6 +64,7 @@ In OpenShift Container Platform, customers can opt out of reporting health and u
64
64
-**`*.apps.<cluster_name>.<base_domain>`** (OR EQUIVALENT ARO URL): When allowlisting domains, this is used in your corporate network to reach applications deployed in OpenShift, or to access the OpenShift console.
65
65
-**`api.openshift.com`**: Used by the cluster for release graph parsing. https://access.redhat.com/labs/ocpupgradegraph/ can be used as an alternative.
66
66
-**`registry.access.redhat.com`**: Registry access is required in your VDI or laptop environment to download dev images when using the ODO CLI tool. (This CLI tool is an alternative CLI tool for developers who aren't familiar with kubernetes). https://docs.openshift.com/container-platform/4.6/cli_reference/developer_cli_odo/understanding-odo.html
67
+
-**`access.redhat.com`**: Used in conjunction with `registry.access.redhat.com` when pulling images. Failure to add this access could result in an error message.
67
68
68
69
## ARO integrations
69
70
@@ -197,7 +198,7 @@ Keep the saved `pull-secret.txt` file somewhere safe - it will be used in each c
197
198
198
199
When running the `az aro create` command, you can reference your pull secret using the `--pull-secret @pull-secret.txt` parameter. Execute `az aro create` from the directory where you stored your `pull-secret.txt` file. Otherwise, replace `@pull-secret.txt` with `@<path-to-my-pull-secret-file`.
199
200
200
-
If you are copying your pull secret or referencing it in other scripts, your pull secret should be formatted as a valid JSON string.
201
+
If you're copying your pull secret or referencing it in other scripts, format your pull secret as a valid JSON string.
Example rule for telemetry to work. Additional possibilities can be found on this [list](https://docs.openshift.com/container-platform/4.3/installing/install_config/configuring-firewall.html#configuring-firewall_configuring-firewall):
251
+
Example rule for telemetry to work. Additional possibilities are listed [here](https://docs.openshift.com/container-platform/4.3/installing/install_config/configuring-firewall.html#configuring-firewall_configuring-firewall):
251
252
```azurecli
252
253
az network firewall application-rule create -g $RESOURCEGROUP -f aro-private \
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments