Skip to content

Commit b62036f

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #276062 from JnHs/jh-arcrb-icu
inbound connectivity URL updates
2 parents 7958a84 + 598072f commit b62036f

File tree

4 files changed

+27
-19
lines changed

4 files changed

+27
-19
lines changed

‎articles/azure-arc/network-requirements-consolidated.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Azure Arc network requirements
33
description: A consolidated list of network requirements for Azure Arc features and Azure Arc-enabled services. Lists endpoints, ports, and protocols.
4-
ms.date: 04/17/2024
4+
ms.date: 05/22/2024
55
ms.topic: reference
66
---
77

‎articles/azure-arc/resource-bridge/includes/network-requirements.md

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
ms.topic: include
3-
ms.date: 03/19/2024
3+
ms.date: 05/22/2024
44
---
55

6-
### Outbound connectivity
6+
### Outbound connectivity requirements
77

88
The firewall and proxy URLs below must be allowlisted in order to enable communication from the management machine, Appliance VM, and Control Plane IP to the required Arc resource bridge URLs.
99

@@ -32,16 +32,24 @@ The firewall and proxy URLs below must be allowlisted in order to enable communi
3232
|Microsoft open source packages manager| 443 | `packages.microsoft.com`| Appliance VM IPs need outbound connection. | Download Linux installation package.|
3333
|Custom Location| 443 | `sts.windows.net`| Appliance VM IPs need outbound connection. | Required for Custom Location.|
3434
|Azure Arc| 443 | `guestnotificationservice.azure.com` | Appliance VM IPs need outbound connection. | Required for Azure Arc.|
35-
|Custom Location | 443 | `k8sconnectcsp.azureedge.net` | Appliance VM IPs need outbound connection. | Required for Custom Location. |
36-
|Diagnostic data | 443 | `gcs.prod.monitoring.core.windows.net` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
37-
|Diagnostic data | 443 | `*.prod.microsoftmetrics.com` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
38-
|Diagnostic data | 443 | `*.prod.hot.ingest.monitor.core.windows.net` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
39-
|Diagnostic data | 443 | `*.prod.warm.ingest.monitor.core.windows.net` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
35+
|Custom Location | 443 | `k8sconnectcsp.azureedge.net` | Appliance VM IPs need outbound connection. | Required for Custom Location. |
36+
|Diagnostic data | 443 | `gcs.prod.monitoring.core.windows.net` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
37+
|Diagnostic data | 443 | `*.prod.microsoftmetrics.com` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
38+
|Diagnostic data | 443 | `*.prod.hot.ingest.monitor.core.windows.net` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
39+
|Diagnostic data | 443 | `*.prod.warm.ingest.monitor.core.windows.net` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
4040
|Azure portal | 443 | `*.arc.azure.net`| Appliance VM IPs need outbound connection. | Manage cluster from Azure portal.|
4141
|Azure CLI & Extension | 443 | `*.blob.core.windows.net`| Management machine needs outbound connection. | Download Azure CLI Installer and extension. |
4242
|Azure Arc Agent| 443 | `*.dp.kubernetesconfiguration.azure.com`| Management machine needs outbound connection. | Dataplane used for Arc agent.|
4343
|Python package| 443 | `pypi.org`, `*.pypi.org`| Management machine needs outbound connection. | Validate Kubernetes and Python versions.|
4444
|Azure CLI| 443 | `pythonhosted.org`, `*.pythonhosted.org`| Management machine needs outbound connection. | Python packages for Azure CLI installation.|
45-
|SSH| 22 | `Arc resource bridge appliance VM IPs` | Management machine needs outbound connection. | Used for troubleshooting the appliance VM.|
46-
|Kubernetes API server| 6443 | `Arc resource bridge appliance VM IPs` | Management machine needs outbound connection. | Management of appliance VM.|
45+
46+
## Inbound connectivity requirements
47+
48+
The following ports must be allowlisted in your firewall/proxy to enable communication between the management machine, Appliance VM IPs, and Control Plane IPs. Ensure these ports are open to facilitate the deployment and maintenance of Arc resource bridge.
49+
50+
|**Service**|**Port**|**URL**|**Direction**|**Notes**|
51+
|--|--|--|--|--|
52+
|SSH| 22 | `appliance VM IPs` and `Management machine` | Bidirectional | Used for deploying and maintaining the appliance VM.|
53+
|Kubernetes API server| 6443 | `appliance VM IPs` and `Management machine` | Bidirectional | Management of the appliance VM.|
54+
|HTTPS | 443 | `private cloud management console` | Management machine needs outbound connection. | Communication with management console (for example, VMware vCenter Server).|
4755

‎articles/azure-arc/resource-bridge/network-requirements.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Azure Arc resource bridge network requirements
33
description: Learn about network requirements for Azure Arc resource bridge including URLs that must be allowlisted.
44
ms.topic: conceptual
5-
ms.date: 03/19/2024
5+
ms.date: 05/22/2024
66
---
77

88
# Azure Arc resource bridge network requirements
@@ -65,7 +65,7 @@ The default value for `noProxy` is `localhost,127.0.0.1,.svc,10.0.0.0/8,172.16.0
6565

6666
As a notice, you should be aware that the appliance VM is configured to listen on the following ports. These ports are used exclusively for internal processes and do not require external access:
6767

68-
- 8443 – Endpoint for AAD Authentication Webhook
68+
- 8443 – Endpoint for Microsoft Entra Authentication Webhook
6969

7070
- 10257 – Endpoint for Arc resource bridge metrics
7171

‎articles/azure-arc/resource-bridge/system-requirements.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Azure Arc resource bridge system requirements
33
description: Learn about system requirements for Azure Arc resource bridge.
44
ms.topic: conceptual
5-
ms.date: 02/09/2024
5+
ms.date: 05/22/2024
66
---
77

88
# Azure Arc resource bridge system requirements
@@ -68,7 +68,7 @@ Management machine requirements:
6868

6969
- communication over port 443 to the private cloud management console (ex: VMware vCenter machine)
7070

71-
- Internal and external DNS resolution. The DNS server must resolve internal names, such as the vCenter endpoint for vSphere or cloud agent service endpoint for Azure Stack HCI. The DNS server must also be able to resolve external addresses that are [required URLs](network-requirements.md#outbound-connectivity) for deployment.
71+
- Internal and external DNS resolution. The DNS server must resolve internal names, such as the vCenter endpoint for vSphere or cloud agent service endpoint for Azure Stack HCI. The DNS server must also be able to resolve external addresses that are [required URLs](network-requirements.md#outbound-connectivity-requirements) for deployment.
7272
- Internet access
7373

7474
## Appliance VM IP address requirements
@@ -79,9 +79,9 @@ Appliance VM IP address requirements:
7979

8080
- Communication with the management machine (SSH TCP port 22, Kubernetes API port 6443)
8181

82-
- Communcation with the private cloud management endpoint via Port 443 (such as VMware vCenter).
82+
- Communication with the private cloud management endpoint via Port 443 (such as VMware vCenter).
8383

84-
- Internet connectivity to [required URLs](network-requirements.md#outbound-connectivity) enabled in proxy/firewall.
84+
- Internet connectivity to [required URLs](network-requirements.md#outbound-connectivity-requirements) enabled in proxy/firewall.
8585
- Static IP assigned and within the IP address prefix.
8686

8787
- Internal and external DNS resolution.
@@ -95,9 +95,9 @@ Reserved appliance VM IP requirements:
9595

9696
- Communication with the management machine (SSH TCP port 22, Kubernetes API port 6443)
9797

98-
- Communcation with the private cloud management endpoint via Port 443 (such as VMware vCenter).
98+
- Communication with the private cloud management endpoint via Port 443 (such as VMware vCenter).
9999

100-
- Internet connectivity to [required URLs](network-requirements.md#outbound-connectivity) enabled in proxy/firewall.
100+
- Internet connectivity to [required URLs](network-requirements.md#outbound-connectivity-requirements) enabled in proxy/firewall.
101101

102102
- Static IP assigned and within the IP address prefix.
103103

@@ -107,7 +107,7 @@ Reserved appliance VM IP requirements:
107107

108108
## Control plane IP requirements
109109

110-
The appliance VM hosts a management Kubernetes cluster with a control plane that requires a single, static IP address. This IP is assigned from the `controlplaneendpoint` parameter in the `createconfig` command or equivalent configuration files creation command.
110+
The appliance VM hosts a management Kubernetes cluster with a control plane that requires a single, static IP address. This IP is assigned from the `controlplaneendpoint` parameter in the `createconfig` command or equivalent configuration files creation command.
111111

112112
Control plane IP requirements:
113113

0 commit comments

Comments
 (0)