You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/openshift/howto-restrict-egress.md
+25-47Lines changed: 25 additions & 47 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,15 @@
1
1
---
2
2
title: Restrict egress traffic in an Azure Red Hat OpenShift (ARO) cluster
3
3
description: Learn what ports and addresses are required to control egress traffic in Azure Red Hat OpenShift (ARO)
4
-
author: sakthi-vetrivel
5
-
ms.author: suvetriv
4
+
author: joharder
5
+
ms.author: joharder
6
6
ms.service: azure-redhat-openshift
7
7
ms.topic: article
8
-
ms.date: 04/09/2021
8
+
ms.date: 06/02/2022
9
9
---
10
10
# Control egress traffic for your Azure Red Hat OpenShift (ARO) cluster (preview)
11
11
12
-
This article provides the necessary details that allow you to secure outbound traffic from your Azure Red Hat OpenShift cluster (ARO). It contains the cluster requirements for a basic ARO deployment, and more requirements for optional Red Hat and third-party components. An [example](#private-aro-cluster-setup) will be provided at the end on how to configure these requirements with Azure Firewall. Keep in mind, you can apply this information to Azure Firewall or to any outbound restriction method or appliance.
12
+
This article provides the necessary details that allow you to secure outbound traffic from your Azure Red Hat OpenShift cluster (ARO). With the release of the [Egress Lockdown Feature](./concepts-egress-lockdown.md), all of the required connections for a private cluster will be proxied through the service. There are additional destinations that you may want to allow to use features such as Operator Hub, or Red Hat telemetry. An [example](#private-aro-cluster-setup) will be provided at the end on how to configure these requirements with Azure Firewall. Keep in mind, you can apply this information to Azure Firewall or to any outbound restriction method or appliance.
13
13
14
14
## Before you begin
15
15
@@ -18,23 +18,20 @@ This article assumes that you're creating a new cluster. If you need a basic ARO
18
18
> [!IMPORTANT]
19
19
> ARO preview features are available on a self-service, opt-in basis. Previews are provided "as is" and "as available," and they're excluded from the service-level agreements and limited warranty. ARO previews are partially covered by customer support on a best-effort basis.
20
20
21
-
## Minimum Required FQDN / application rules
21
+
## Minimum Required FQDN - Proxied through ARO service
22
22
23
23
This list is based on the list of FQDNs found in the OpenShift docs here: https://docs.openshift.com/container-platform/4.6/installing/install_config/configuring-firewall.html
24
24
25
-
The following FQDN / application rulesare required:
25
+
The following FQDNs are proxied through the service, and will not need additional firewall rules. They are here for informational purposes.
26
26
27
27
| Destination FQDN | Port | Use |
28
28
| ----------- | ----------- | ------------- |
29
-
|**`*.quay.io`**|**HTTPS:443**| Mandatory for the installation, used by the cluster. This is used by the cluster to download the platform container images. |
30
-
| **`registry.redhat.io`** | **HTTPS:443** | Mandatory for core add-ons. This is used by the cluster to download core components such as dev tools, operator-based add-ons, and Red Hat provided container images.
31
-
|**`mirror.openshift.com`**|**HTTPS:443**| This is required in the VDI environment or your laptop to access mirrored installation content and images. It's required in the cluster to download platform release signatures to know what images to pull from quay.io. |
32
-
|**`api.openshift.com`**|**HTTPS:443**| Required by the cluster to check if there are available updates before downloading the image signatures. |
33
29
|**`arosvc.azurecr.io`**|**HTTPS:443**| Global Internal Private registry for ARO Operators. Required if you do not allow the service-endpoints Microsoft.ContainerRegistry on your subnets. |
34
30
|**`arosvc.$REGION.data.azurecr.io`**|**HTTPS:443**| Regional Internal Private registry for ARO Operators. Required if you do not allow the service-endpoints Microsoft.ContainerRegistry on your subnets. |
35
31
|**`management.azure.com`**|**HTTPS:443**| This is used by the cluster to access Azure APIs. |
36
32
|**`login.microsoftonline.com`**|**HTTPS:443**| This is used by the cluster for authentication to Azure. |
37
-
|**`gcs.prod.monitoring.core.windows.net`**|**HTTPS:443**| This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
33
+
|**`*.monitor.core.windows.net`**|**HTTPS:443**| This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
34
+
|**`*.monitoring.core.windows.net`**|**HTTPS:443**| This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
38
35
|**`*.blob.core.windows.net`**|**HTTPS:443**| This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
39
36
|**`*.servicebus.windows.net`**|**HTTPS:443**| This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
40
37
|**`*.table.core.windows.net`**|**HTTPS:443**| This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s). |
@@ -44,52 +41,33 @@ The following FQDN / application rules are required:
44
41
45
42
---
46
43
47
-
## Complete list of required and optional FQDNs
44
+
## List of optional FQDNs
48
45
49
-
### FIRST GROUP: INSTALLING AND DOWNLOADING PACKAGES AND TOOLS
46
+
### INSTALLING AND DOWNLOADING PACKAGES AND TOOLS
50
47
51
-
-**`quay.io`**: Mandatory for the installation, used by the cluster. This is used by the cluster to download the platform container images.
52
-
-**`registry.redhat.io`**: Mandatory for core add-ons. This is used by the cluster to download core components such as dev tools, operator-based add-ons, or Red Hat provided container images such as our middleware, the Universal Base Image...
53
-
-**`sso.redhat.com`**: This one is required in the VDI environment or your laptop to connect to cloud.redhat.com. This is the site where we can download the pull secret, and use some of the SaaS solutions we offer in Red Hat to facilitate monitoring of your subscriptions, cluster inventory, chargeback reporting, among other things.
54
-
-**`openshift.org`**: This one is required in the VDI environment or your laptop to connect to download RH CoreOS images, but in Azure they are picked from the marketplace, there is no need to download OS images.
48
+
-**`registry.redhat.io`**: Used to provide images for things such as Operator Hub.
55
49
56
50
---
57
51
58
-
### SECOND GROUP: TELEMETRY
52
+
### TELEMETRY
59
53
60
54
All this section can be opted out, but before we know how, please check what it is: https://docs.openshift.com/container-platform/4.6/support/remote_health_monitoring/about-remote-health-monitoring.html
61
-
-**`cert-api.access.redhat.com`**: Use in your VDI or laptop environment.
62
-
-**`api.access.redhat.com`**: Use in your VDI or laptop environment.
63
-
-**`infogw.api.openshift.com`**: Use in your VDI or laptop environment.
64
-
-**`https://cloud.redhat.com/api/ingress`**: Use in the cluster for the insights operator who integrates with the aaS Red Hat Insights.
55
+
-**`cert-api.access.redhat.com`**: Used for Red Hat telemetry.
56
+
-**`api.access.redhat.com`**: Used for Red Hat telemetry.
57
+
-**`infogw.api.openshift.com`**: Used for Red Hat telemetry.
58
+
-**`https://cloud.redhat.com/api/ingress`**: Use in the cluster for the insights operator who integrates with Red Hat Insights.
65
59
In OpenShift Container Platform, customers can opt out of reporting health and usage information. However, connected clusters allow Red Hat to react more quickly to problems and better support our customers, and better understand how product upgrades clusters. Check details here: https://docs.openshift.com/container-platform/4.6/support/remote_health_monitoring/opting-out-of-remote-health-reporting.html.
66
60
67
61
---
68
62
69
-
### THIRD GROUP: CLOUD APIs
70
-
71
-
-**`management.azure.com`**: This is used by the cluster to access Azure APIs.
72
-
73
-
---
74
-
75
-
### FOURTH GROUP: OTHER OPENSHIFT REQUIREMENTS
63
+
### OTHER POSSIBLE OPENSHIFT REQUIREMENTS
76
64
77
-
-**`mirror.openshift.com`**: This one is required in the VDI environment or your laptop to access mirrored installation content and images and required in the cluster to download platform release signatures, used by the cluster to know what images to pull from quay.io.
78
-
-**`storage.googleapis.com/openshift-release`**: Alternative site to download platform release signatures, used by the cluster to know what images to pull from quay.io.
79
-
-**`*.apps.<cluster_name>.<base_domain>`** (OR EQUIVALENT ARO URL): When allowlisting domains, this is use in your corporate network to reach applications deployed in OpenShift, or to access the OpenShift console.
80
-
-**`api.openshift.com`**: Required by the cluster to check if there are available updates before downloading the image signatures.
65
+
-**`quay.io`**: May be used to download images from the Red Hat managed Quay registry. Also a possible fall-back target for ARO required system images.
66
+
-**`mirror.openshift.com`**: Required to access mirrored installation content and images. This site is also a source of release image signatures.
67
+
-**`*.apps.<cluster_name>.<base_domain>`** (OR EQUIVALENT ARO URL): When allowlisting domains, this is used in your corporate network to reach applications deployed in OpenShift, or to access the OpenShift console.
68
+
-**`api.openshift.com`**: Used by the cluster for release graph parsing. https://access.redhat.com/labs/ocpupgradegraph/ can be used as an alternative.
81
69
-**`registry.access.redhat.com`**: Registry access is required in your VDI or laptop environment to download dev images when using the ODO CLI tool. (This CLI tool is an alternative CLI tool for developers who aren't familiar with kubernetes). https://docs.openshift.com/container-platform/4.6/cli_reference/developer_cli_odo/understanding-odo.html
82
70
83
-
---
84
-
85
-
### FIFTH GROUP: MICROSOFT & RED HAT ARO MONITORING SERVICE
86
-
87
-
-**`login.microsoftonline.com`**: This is used by the cluster for authentication to Azure.
88
-
-**`gcs.prod.monitoring.core.windows.net`**: This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s).
89
-
-**`*.blob.core.windows.net`**: This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s).
90
-
-**`*.servicebus.windows.net`**: This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s).
91
-
-**`*.table.core.windows.net`**: This is used for Microsoft Geneva Monitoring so that the ARO team can monitor the customer's cluster(s).
Rule for OpenShift to work based on this [list](https://docs.openshift.com/container-platform/4.3/installing/install_config/configuring-firewall.html#configuring-firewall_configuring-firewall):
253
+
Example rule for telemetry to work. Additional possibilities can be found on this [list](https://docs.openshift.com/container-platform/4.3/installing/install_config/configuring-firewall.html#configuring-firewall_configuring-firewall):
276
254
```azurecli
277
255
az network firewall application-rule create -g $RESOURCEGROUP -f aro-private \
0 commit comments