Skip to content

Commit cc541bf

Browse files
huypubhuypub
authored
Merge pull request #221577 from MicrosoftDocs/release-arc-endpoints
Draft: Consolidated Arc Endpoints
2 parents c0a2a7e + cdfa26d commit cc541bf

16 files changed

+371
-343
lines changed

‎articles/azure-arc/data/connectivity.md

Lines changed: 3 additions & 169 deletions
Original file line numberDiff line numberDiff line change
@@ -73,174 +73,8 @@ Some Azure-attached services are only available when they can be directly reache
7373

7474
## Details on internet addresses, ports, encryption, and proxy server support
7575

76-
There are three connections required to services available on the Internet. These connections include:
76+
[!INCLUDE [network-requirements](includes/network-requirements.md)]
7777

78-
- [Microsoft Container Registry (MCR)](#microsoft-container-registry-mcr)
79-
- [Helm chart (direct connected mode)](#helm-chart-direct-connected-mode)
80-
- [Azure Resource Manager APIs](#azure-resource-manager-apis)
81-
- [Azure monitor APIs](#azure-monitor-apis)
82-
- [Azure Arc data processing service](#azure-arc-data-processing-service)
78+
## Additional network requirements
8379

84-
All HTTPS connections to Azure and the Microsoft Container Registry are encrypted using SSL/TLS using officially signed and verifiable certificates.
85-
86-
The following sections provide details for these connections.
87-
88-
### Microsoft Container Registry (MCR)
89-
90-
The Microsoft Container Registry hosts the Azure Arc-enabled data services container images. You can pull these images from MCR and push them to a private container registry and configure the data controller deployment process to pull the container images from that private container registry.
91-
92-
#### Connection source
93-
94-
The Kubernetes kubelet on each of the Kubernetes nodes pulling the container images.
95-
96-
#### Connection target
97-
98-
`mcr.microsoft.com`
99-
100-
#### Protocol
101-
102-
HTTPS
103-
104-
#### Port
105-
106-
443
107-
108-
#### Can use proxy
109-
110-
Yes
111-
112-
#### Authentication
113-
114-
None
115-
116-
### Helm chart (direct connected mode)
117-
118-
The Helm chart used to provision the Azure Arc data controller bootstrapper and cluster level objects, such as custom resource definitions, cluster roles, and cluster role bindings, is pulled from an Azure Container Registry.
119-
120-
#### Connection source
121-
122-
The Kubernetes kubelet on each of the Kubernetes nodes pulling the container images.
123-
124-
#### Connection target
125-
126-
`arcdataservicesrow1.azurecr.io`
127-
128-
#### Protocol
129-
130-
HTTPS
131-
132-
#### Port
133-
134-
443
135-
136-
#### Can use proxy
137-
138-
Yes
139-
140-
#### Authentication
141-
142-
None
143-
144-
### Azure Resource Manager APIs
145-
Azure Data Studio, and Azure CLI connect to the Azure Resource Manager APIs to send and retrieve data to and from Azure for some features.
146-
147-
#### Connection source
148-
149-
A computer running Azure Data Studio, or Azure CLI that is connecting to Azure.
150-
151-
#### Connection target
152-
153-
- `login.microsoftonline.com`
154-
- `management.azure.com`
155-
156-
#### Protocol
157-
158-
HTTPS
159-
160-
#### Port
161-
162-
443
163-
164-
#### Can use proxy
165-
166-
Yes
167-
168-
To use proxy, verify that the agents meet the network requirements. See [Meet network requirements](../kubernetes/quickstart-connect-cluster.md#meet-network-requirements).
169-
170-
#### Authentication
171-
172-
Azure Active Directory
173-
174-
### Azure monitor APIs
175-
176-
Azure Data Studio and Azure CLI connect to the Azure Resource Manager APIs to send and retrieve data to and from Azure for some features.
177-
178-
#### Connection source
179-
180-
A computer running Azure CLI that is uploading monitoring metrics or logs to Azure Monitor.
181-
182-
#### Connection target
183-
184-
- `login.microsoftonline.com`
185-
- `management.azure.com`
186-
- `*.ods.opinsights.azure.com`
187-
- `*.oms.opinsights.azure.com`
188-
- `*.monitoring.azure.com`
189-
190-
For example, to upload usage metrics data services will connect to `https://<azureRegion>.monitoring.azure.com/` where `<azureRegion>` is the region where data services is deployed.
191-
192-
Likewise, data services will connect to the log analytics workspace at `https://<subscription_id>.ods.opinsights.azure.com` where `<subscription_id>` represents your Azure subscription.
193-
194-
#### Protocol
195-
196-
HTTPS
197-
198-
#### Port
199-
200-
443
201-
202-
#### Can use proxy
203-
204-
Yes
205-
206-
#### Authentication
207-
208-
Azure Active Directory
209-
210-
> [!NOTE]
211-
> For now, all browser HTTPS/443 connections to the data controller for running the command `az arcdata dc export` and Grafana and Kibana dashboards are SSL encrypted using self-signed certificates. A feature will be available in the future that will allow you to provide your own certificates for encryption of these SSL connections.
212-
213-
Connectivity from Azure Data Studio to the Kubernetes API server uses the Kubernetes authentication and encryption that you have established. Each user that is using Azure Data Studio or CLI must have an authenticated connection to the Kubernetes API to perform many of the actions related to Azure Arc-enabled data services.
214-
215-
### Azure Arc data processing service
216-
217-
Points to the data processing service endpoint in connection
218-
219-
#### Connection target
220-
221-
- `san-af-eastus-prod.azurewebsites.net`
222-
- `san-af-eastus2-prod.azurewebsites.net`
223-
- `san-af-australiaeast-prod.azurewebsites.net`
224-
- `san-af-centralus-prod.azurewebsites.net`
225-
- `san-af-westus2-prod.azurewebsites.net`
226-
- `san-af-westeurope-prod.azurewebsites.net`
227-
- `san-af-southeastasia-prod.azurewebsites.net`
228-
- `san-af-koreacentral-prod.azurewebsites.net`
229-
- `san-af-northeurope-prod.azurewebsites.net`
230-
- `san-af-westeurope-prod.azurewebsites.net`
231-
- `san-af-uksouth-prod.azurewebsites.net`
232-
- `san-af-francecentral-prod.azurewebsites.net`
233-
234-
#### Protocol
235-
236-
HTTPS
237-
238-
#### Can use proxy
239-
240-
Yes
241-
242-
To use proxy, verify that the agents meet the network requirements. See [Meet network requirements](../kubernetes/quickstart-connect-cluster.md#meet-network-requirements).
243-
244-
#### Authentication
245-
246-
None
80+
In addition, resource bridge (preview) requires [Arc-enabled Kubernetes endpoints](../network-requirements-consolidated.md#azure-arc-enabled-kubernetes-endpoints).

‎articles/azure-arc/data/includes/network-requirements.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
author: MikeRayMSFT
3+
ms.author: mikeray
4+
ms.service: azure-arc
5+
ms.topic: include
6+
ms.date: 12/13/2022
7+
---
8+
9+
10+
|**Service**|**Port**|**URL**|**Direction**|**Notes**|
11+
|--|--|--|--|--|
12+
| Helm chart (direct connected mode only) | 443 | `arcdataservicesrow1.azurecr.io` | Outbound |Provisions the Azure Arc data controller bootstrapper and cluster level objects, such as custom resource definitions, cluster roles, and cluster role bindings, is pulled from an Azure Container Registry. |
13+
| Azure monitor APIs <sup>*</sup> | 443 |`*.ods.opinsights.azure.com`<br/>`*.oms.opinsights.azure.com`<br/>`*.monitoring.azure.com` | Outbound | Azure Data Studio and Azure CLI connect to the Azure Resource Manager APIs to send and retrieve data to and from Azure for some features. See [Azure Monitor APIs](#azure-monitor-apis).
14+
| Azure Arc data processing service <sup>*</sup>| 443 |`san-af-<region>-prod.azurewebsites.net` | Outbound<br/> Inbound |
15+
16+
<sup>*</sup> Requirement depends on deployment mode:
17+
18+
- For direct mode, the controller pod on the Kubernetes cluster needs to have outbound connectivity to the endpoints to send the logs, metrics, inventory, and billing information to Azure Monitor/Data Processing Service.
19+
- For indirect mode, the machine that runs `az arcdata dc upload` needs to have the outbound connectivity to Azure Monitor and Data Processing Service.
20+
21+
### Azure Monitor APIs
22+
23+
Connectivity from Azure Data Studio to the Kubernetes API server uses the Kubernetes authentication and encryption that you have established. Each user that is using Azure Data Studio or CLI must have an authenticated connection to the Kubernetes API to perform many of the actions related to Azure Arc-enabled data services.

‎articles/azure-arc/data/overview.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ Many of the services such as self-service provisioning, automated backups/restor
5252

5353
To see the regions that currently support Azure Arc-enabled data services, go to [Azure Products by Region - Azure Arc](https://azure.microsoft.com/global-infrastructure/services/?cdn=disable&products=azure-arc).
5454

55+
[!INCLUDE [arc-region-note](../includes/arc-region-note.md)]
56+
5557
## Next steps
5658

5759
> **Just want to try things out?**

‎articles/azure-arc/includes/arc-region-note.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
author: MikeRayMSFT
3+
ms.author: mikeray
4+
ms.service: azure-arc
5+
ms.topic: include
6+
ms.date: 12/13/2022
7+
---
8+
9+
To get the region segment of a regional endpoint, remove all spaces from the Azure region name. For example, *East US 2* region, the region name is `eastus2`.
10+
11+
For example: `san-af-<region>-prod.azurewebsites.net` should be `san-af-eastus2-prod.azurewebsites.net` in the East US 2 region.
12+
13+
To see a list of all regions, run this command:
14+
15+
```azcli
16+
az account list-locations -o table
17+
```

‎articles/azure-arc/includes/network-requirement-principles.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
ms.service: azure-arc
3+
ms.topic: include
4+
ms.date: 12/13/2022
5+
---
6+
7+
Generally, connectivity requirements include these principles:
8+
9+
- All connections are TCP unless otherwise specified.
10+
- All HTTP connections use HTTPS and SSL/TLS with officially signed and verifiable certificates.
11+
- All connections are outbound unless otherwise specified.
12+
13+
To use a proxy, verify that the agents meet the network requirements in this article.

‎articles/azure-arc/kubernetes/cluster-connect.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ Before you begin, review the [conceptual overview of the cluster connect feature
8888

8989
---
9090

91+
[!INCLUDE [arc-region-note](../includes/arc-region-note.md)]
92+
9193
## Azure Active Directory authentication option
9294

9395
### [Azure CLI](#tab/azure-cli)

‎articles/azure-arc/kubernetes/includes/network-requirements.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
ms.service: azure-arc
3+
ms.topic: include
4+
ms.date: 12/13/2022
5+
---
6+
7+
### [Azure Cloud](#tab/azure-cloud)
8+
9+
> [!IMPORTANT]
10+
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
11+
> For `*.servicebus.windows.net`, websockets need to be enabled for outbound access on firewall and proxy.
12+
13+
| Endpoint (DNS) | Description |
14+
| ----------------- | ------------- |
15+
| `https://management.azure.com` | Required for the agent to connect to Azure and register the cluster. |
16+
| `https://<region>.dp.kubernetesconfiguration.azure.com` | Data plane endpoint for the agent to push status and fetch configuration information. |
17+
| `https://login.microsoftonline.com`<br/>`https://<region>.login.microsoft.com`<br/>`login.windows.net`| Required to fetch and update Azure Resource Manager tokens. |
18+
| `https://mcr.microsoft.com`<br/>`https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
19+
| `https://gbl.his.arc.azure.com` | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
20+
| `https://*.his.arc.azure.com` | Required to pull system-assigned Managed Identity certificates. |
21+
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
22+
|`guestnotificationservice.azure.com`<br/>`*.guestnotificationservice.azure.com`<br/>`sts.windows.net`<br/>`https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
23+
|`*.servicebus.windows.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
24+
|`https://graph.microsoft.com/` | Required when [Azure RBAC](../azure-rbac.md) is configured |
25+
| `*.arc.azure.net`| To manage connected clusters in Azure portal. |
26+
27+
To translate the `*.servicebus.windows.net` wildcard into specific endpoints, use the command:
28+
29+
```rest
30+
GET https://guestnotificationservice.azure.com/urls/allowlist?api-version=2020-01-01&location=<region>`.
31+
```
32+
33+
[!INCLUDE [arc-region-note](../../includes/arc-region-note.md)]
34+
35+
### [Azure Government](#tab/azure-government)
36+
37+
> [!IMPORTANT]
38+
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
39+
> For `*.servicebus.usgovcloudapi.net`, websockets need to be enabled for outbound access on firewall and proxy.
40+
41+
| Endpoint (DNS) | Description |
42+
| ----------------- | ------------- |
43+
|`https://management.usgovcloudapi.net` | Required for the agent to connect to Azure and register the cluster. |
44+
| `https://<region>.dp.kubernetesconfiguration.azure.us` | Data plane endpoint for the agent to push status and fetch configuration information. |
45+
| `https://login.microsoftonline.us`<br/>`<region>.login.microsoftonline.us` | Required to fetch and update Azure Resource Manager tokens. |
46+
| `https://mcr.microsoft.com`<br/>`https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
47+
| `https://gbl.his.arc.azure.us` | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
48+
| `https://usgv.his.arc.azure.us` | Required to pull system-assigned Managed Identity certificates. |
49+
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
50+
|`guestnotificationservice.azure.us`<br/>`*.guestnotificationservice.azure.us`<br/>`sts.windows.net`<br/>`https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
51+
|`*.servicebus.usgovcloudapi.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
52+
|`https://graph.microsoft.com/` | Required when [Azure RBAC](../azure-rbac.md) is configured |
53+
54+
To translate the `*.servicebus.usgovcloudapi.net` wildcard into specific endpoints, use the command:
55+
56+
```rest
57+
\GET https://guestnotificationservice.azure.us/urls/allowlist?api-version=2020-01-01&location=region
58+
```
59+
60+
[!INCLUDE [arc-region-note](../../includes/arc-region-note.md)]
61+
62+
#### [Azure China](#tab/azure-china)
63+
64+
> [!NOTE]
65+
> Azure Arc-enabled Kubernetes is not available in Azure China regions at this time.
66+
67+
---

‎articles/azure-arc/kubernetes/quickstart-connect-cluster.md

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -131,28 +131,11 @@ For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enable
131131
132132
## Meet network requirements
133133
134-
> [!IMPORTANT]
135-
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
136-
> For `*.servicebus.windows.net` (for Azure Cloud) & `*.servicebus.usgovcloudapi.net` (for Azure US Government), websockets need to be enabled for outbound access on firewall and proxy.
137-
138-
| Endpoint (DNS) | Description |
139-
| ----------------- | ------------- |
140-
| `https://management.azure.com` (for Azure Cloud), `https://management.usgovcloudapi.net` (for Azure US Government) | Required for the agent to connect to Azure and register the cluster. |
141-
| `https://<region>.dp.kubernetesconfiguration.azure.com` (for Azure Cloud), `https://<region>.dp.kubernetesconfiguration.azure.us` (for Azure US Government) | Data plane endpoint for the agent to push status and fetch configuration information. |
142-
| `https://login.microsoftonline.com`, `https://<region>.login.microsoft.com`, `login.windows.net` (for Azure Cloud), `https://login.microsoftonline.us`, `<region>.login.microsoftonline.us` (for Azure US Government) | Required to fetch and update Azure Resource Manager tokens. |
143-
| `https://mcr.microsoft.com`, `https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
144-
| `https://gbl.his.arc.azure.com` (for Azure Cloud), `https://gbl.his.arc.azure.us` (for Azure US Government) | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
145-
| `https://*.his.arc.azure.com` (for Azure Cloud), `https://usgv.his.arc.azure.us` (for Azure US Government) | Required to pull system-assigned Managed Identity certificates. |
146-
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
147-
|`guestnotificationservice.azure.com`, `*.guestnotificationservice.azure.com`, `sts.windows.net`, `https://k8sconnectcsp.azureedge.net`(for Azure Cloud), `guestnotificationservice.azure.us`, `*.guestnotificationservice.azure.us`, `sts.windows.net`, `https://k8sconnectcsp.azureedge.us` (for Azure US Government) | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
148-
|`*.servicebus.windows.net`(for Azure Cloud), `*.servicebus.usgovcloudapi.net` (for Azure US Government) | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
149-
|`https://graph.microsoft.com/` | Required when [Azure RBAC](azure-rbac.md) is configured |
134+
[!INCLUDE [network-requirement-principles](../includes/network-requirement-principles.md)]
150135
151-
> [!NOTE]
152-
> For Azure Cloud to translate the `*.servicebus.windows.net` wildcard into specific endpoints, use the command `\GET https://guestnotificationservice.azure.com/urls/allowlist?api-version=2020-01-01&location=<location>`. For Azure US Government to translate the `*.servicebus.usgovcloudapi.net` wildcard into specific endpoints, use the command `\GET https://guestnotificationservice.azure.us/urls/allowlist?api-version=2020-01-01&location=<location>`. Within these commands, the region must be specified for the `<location>` placeholder.
136+
[!INCLUDE [network-requirements](includes/network-requirements.md)]
153137
154-
> [!IMPORTANT]
155-
> To view and manage connected clusters in the Azure portal, be sure that your network allows traffic to `*.arc.azure.net`.
138+
For a complete list of network requirements for Azure Arc features and Azure Arc-enabled services, see [Azure Arc network requirements (Consolidated)](../network-requirements-consolidated.md).
156139
157140
## Create a resource group
158141

0 commit comments

Comments
 (0)