Skip to content

Commit f74cd41

Browse files
American-DipperAmerican-Dipper
authored
Merge pull request #266435 from JnHs/jh-arc-rbnetreqk8
display k8s requirements
2 parents 314fae3 + 9192024 commit f74cd41

File tree

7 files changed

+101
-82
lines changed

7 files changed

+101
-82
lines changed

‎articles/azure-arc/kubernetes/includes/network-requirements-azure-china.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
ms.service: azure-arc
3+
ms.topic: include
4+
ms.date: 02/15/2024
5+
---
6+
7+
> [!IMPORTANT]
8+
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
9+
> For `*.servicebus.chinacloudapi.cn`, websockets need to be enabled for outbound access on firewall and proxy.
10+
11+
| Endpoint (DNS) | Description |
12+
| ----------------- | ------------- |
13+
| `https://management.chinacloudapi.cn` | Required for the agent to connect to Azure and register the cluster. |
14+
| `https://<region>.dp.kubernetesconfiguration.azure.cn` | Data plane endpoint for the agent to push status and fetch configuration information. |
15+
| `https://login.chinacloudapi.cn`<br/>`https://<region>.login.chinacloudapi.cn`<br/>`login.partner.microsoftonline.cn`| Required to fetch and update Azure Resource Manager tokens. |
16+
| `mcr.azk8s.cn` | Required to pull container images for Azure Arc agents. |
17+
| `https://gbl.his.arc.azure.cn` | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
18+
| `https://*.his.arc.azure.cn` | Required to pull system-assigned Managed Identity certificates. |
19+
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
20+
|`guestnotificationservice.azure.cn`<br/>`*.guestnotificationservice.azure.cn`<br/>`sts.chinacloudapi.cn`<br/>`https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
21+
|`*.servicebus.chinacloudapi.cn` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
22+
|`https://graph.chinacloudapi.cn/` | Required when [Azure RBAC](../azure-rbac.md) is configured. |
23+
|`*.arc.azure.cn` | Required to manage connected clusters in Azure portal.|
24+
|`https://<region>.obo.arc.azure.cn:8084/` | Required when [Cluster Connect](../cluster-connect.md) is configured. |
25+
|`dl.k8s.io`| Required when [automatic agent upgrade](../agent-upgrade.md#toggle-automatic-upgrade-on-or-off-when-connecting-a-cluster-to-azure-arc) is enabled. |
26+
|`quay.azk8s.cn`<br/>`registryk8s.azk8s.cn`<br/>`k8sgcr.azk8s.cn`<br/>`usgcr.azk8s.cn`<br/>`dockerhub.azk8s.cn/<repo-name>/<image-name>:<version>`|Container registry proxy servers for Azure China VMs.|

‎articles/azure-arc/kubernetes/includes/network-requirements-azure-cloud.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
ms.service: azure-arc
3+
ms.topic: include
4+
ms.date: 02/15/2024
5+
---
6+
7+
> [!IMPORTANT]
8+
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
9+
> For `*.servicebus.windows.net`, websockets need to be enabled for outbound access on firewall and proxy.
10+
11+
| Endpoint (DNS) | Description |
12+
| ----------------- | ------------- |
13+
| `https://management.azure.com` | Required for the agent to connect to Azure and register the cluster. |
14+
| `https://<region>.dp.kubernetesconfiguration.azure.com` | Data plane endpoint for the agent to push status and fetch configuration information. |
15+
| `https://login.microsoftonline.com`<br/>`https://<region>.login.microsoft.com`<br/>`login.windows.net`| Required to fetch and update Azure Resource Manager tokens. |
16+
| `https://mcr.microsoft.com`<br/>`https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
17+
| `https://gbl.his.arc.azure.com` | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
18+
| `https://*.his.arc.azure.com` | Required to pull system-assigned Managed Identity certificates. |
19+
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
20+
|`guestnotificationservice.azure.com`<br/>`*.guestnotificationservice.azure.com`<br/>`sts.windows.net`<br/>`https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
21+
|`*.servicebus.windows.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
22+
|`https://graph.microsoft.com/` | Required when [Azure RBAC](../azure-rbac.md) is configured. |
23+
| `*.arc.azure.net`| Required to manage connected clusters in Azure portal. |
24+
|`https://<region>.obo.arc.azure.com:8084/` | Required when [Cluster Connect](../cluster-connect.md) is configured. |
25+
|`dl.k8s.io`| Required when [automatic agent upgrade](../agent-upgrade.md#toggle-automatic-upgrade-on-or-off-when-connecting-a-cluster-to-azure-arc) is enabled. |
26+
27+
To translate the `*.servicebus.windows.net` wildcard into specific endpoints, use the command:
28+
29+
```rest
30+
GET https://guestnotificationservice.azure.com/urls/allowlist?api-version=2020-01-01&location=<region>
31+
```
32+
33+
[!INCLUDE [arc-region-note](../../includes/arc-region-note.md)]

‎articles/azure-arc/kubernetes/includes/network-requirements-azure-government.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
ms.service: azure-arc
3+
ms.topic: include
4+
ms.date: 02/15/2024
5+
---
6+
7+
> [!IMPORTANT]
8+
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
9+
> For `*.servicebus.usgovcloudapi.net`, websockets need to be enabled for outbound access on firewall and proxy.
10+
11+
| Endpoint (DNS) | Description |
12+
| ----------------- | ------------- |
13+
|`https://management.usgovcloudapi.net` | Required for the agent to connect to Azure and register the cluster. |
14+
| `https://<region>.dp.kubernetesconfiguration.azure.us` | Data plane endpoint for the agent to push status and fetch configuration information. |
15+
| `https://login.microsoftonline.us`<br/>`<region>.login.microsoftonline.us` | Required to fetch and update Azure Resource Manager tokens. |
16+
| `https://mcr.microsoft.com`<br/>`https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
17+
| `https://gbl.his.arc.azure.us` | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
18+
| `https://usgv.his.arc.azure.us` | Required to pull system-assigned Managed Identity certificates. |
19+
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
20+
|`guestnotificationservice.azure.us`<br/>`*.guestnotificationservice.azure.us`<br/>`sts.windows.net`<br/>`https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
21+
|`*.servicebus.usgovcloudapi.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
22+
|`https://graph.microsoft.com/` | Required when [Azure RBAC](../azure-rbac.md) is configured. |
23+
|`https://usgovvirginia.obo.arc.azure.us:8084/` | Required when [Cluster Connect](../cluster-connect.md) is configured. |
24+
|`dl.k8s.io`| Required when [automatic agent upgrade](../agent-upgrade.md#toggle-automatic-upgrade-on-or-off-when-connecting-a-cluster-to-azure-arc) is enabled. |
25+
26+
To translate the `*.servicebus.usgovcloudapi.net` wildcard into specific endpoints, use the command:
27+
28+
```rest
29+
GET https://guestnotificationservice.azure.us/urls/allowlist?api-version=2020-01-01&location=region
30+
```
31+
32+
[!INCLUDE [arc-region-note](../../includes/arc-region-note.md)]

‎articles/azure-arc/kubernetes/includes/network-requirements.md

Lines changed: 4 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,87 +1,17 @@
11
---
22
ms.service: azure-arc
33
ms.topic: include
4-
ms.date: 09/28/2023
4+
ms.date: 02/15/2024
55
---
66

77
### [Azure Cloud](#tab/azure-cloud)
88

9-
> [!IMPORTANT]
10-
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
11-
> For `*.servicebus.windows.net`, websockets need to be enabled for outbound access on firewall and proxy.
12-
13-
| Endpoint (DNS) | Description |
14-
| ----------------- | ------------- |
15-
| `https://management.azure.com` | Required for the agent to connect to Azure and register the cluster. |
16-
| `https://<region>.dp.kubernetesconfiguration.azure.com` | Data plane endpoint for the agent to push status and fetch configuration information. |
17-
| `https://login.microsoftonline.com`<br/>`https://<region>.login.microsoft.com`<br/>`login.windows.net`| Required to fetch and update Azure Resource Manager tokens. |
18-
| `https://mcr.microsoft.com`<br/>`https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
19-
| `https://gbl.his.arc.azure.com` | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
20-
| `https://*.his.arc.azure.com` | Required to pull system-assigned Managed Identity certificates. |
21-
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
22-
|`guestnotificationservice.azure.com`<br/>`*.guestnotificationservice.azure.com`<br/>`sts.windows.net`<br/>`https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
23-
|`*.servicebus.windows.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
24-
|`https://graph.microsoft.com/` | Required when [Azure RBAC](../azure-rbac.md) is configured. |
25-
| `*.arc.azure.net`| Required to manage connected clusters in Azure portal. |
26-
|`https://<region>.obo.arc.azure.com:8084/` | Required when [Cluster Connect](../cluster-connect.md) is configured. |
27-
|`dl.k8s.io`| Required when [automatic agent upgrade](../agent-upgrade.md#toggle-automatic-upgrade-on-or-off-when-connecting-a-cluster-to-azure-arc) is enabled. |
28-
29-
To translate the `*.servicebus.windows.net` wildcard into specific endpoints, use the command:
30-
31-
```rest
32-
GET https://guestnotificationservice.azure.com/urls/allowlist?api-version=2020-01-01&location=<region>
33-
```
34-
35-
[!INCLUDE [arc-region-note](../../includes/arc-region-note.md)]
9+
[!INCLUDE [network-requirements-azure-cloud.md](network-requirements-azure-cloud.md)]
3610

3711
### [Azure Government](#tab/azure-government)
3812

39-
> [!IMPORTANT]
40-
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
41-
> For `*.servicebus.usgovcloudapi.net`, websockets need to be enabled for outbound access on firewall and proxy.
42-
43-
| Endpoint (DNS) | Description |
44-
| ----------------- | ------------- |
45-
|`https://management.usgovcloudapi.net` | Required for the agent to connect to Azure and register the cluster. |
46-
| `https://<region>.dp.kubernetesconfiguration.azure.us` | Data plane endpoint for the agent to push status and fetch configuration information. |
47-
| `https://login.microsoftonline.us`<br/>`<region>.login.microsoftonline.us` | Required to fetch and update Azure Resource Manager tokens. |
48-
| `https://mcr.microsoft.com`<br/>`https://*.data.mcr.microsoft.com` | Required to pull container images for Azure Arc agents. |
49-
| `https://gbl.his.arc.azure.us` | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
50-
| `https://usgv.his.arc.azure.us` | Required to pull system-assigned Managed Identity certificates. |
51-
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
52-
|`guestnotificationservice.azure.us`<br/>`*.guestnotificationservice.azure.us`<br/>`sts.windows.net`<br/>`https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
53-
|`*.servicebus.usgovcloudapi.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
54-
|`https://graph.microsoft.com/` | Required when [Azure RBAC](../azure-rbac.md) is configured. |
55-
|`https://usgovvirginia.obo.arc.azure.us:8084/` | Required when [Cluster Connect](../cluster-connect.md) is configured. |
56-
|`dl.k8s.io`| Required when [automatic agent upgrade](../agent-upgrade.md#toggle-automatic-upgrade-on-or-off-when-connecting-a-cluster-to-azure-arc) is enabled. |
57-
58-
To translate the `*.servicebus.usgovcloudapi.net` wildcard into specific endpoints, use the command:
59-
60-
```rest
61-
GET https://guestnotificationservice.azure.us/urls/allowlist?api-version=2020-01-01&location=region
62-
```
63-
64-
[!INCLUDE [arc-region-note](../../includes/arc-region-note.md)]
13+
[!INCLUDE [network-requirements-azure-government.md](network-requirements-azure-government.md)]
6514

6615
#### [Microsoft Azure operated by 21Vianet](#tab/azure-china)
6716

68-
> [!IMPORTANT]
69-
> Azure Arc agents require the following outbound URLs on `https://:443` to function.
70-
> For `*.servicebus.chinacloudapi.cn`, websockets need to be enabled for outbound access on firewall and proxy.
71-
72-
| Endpoint (DNS) | Description |
73-
| ----------------- | ------------- |
74-
| `https://management.chinacloudapi.cn` | Required for the agent to connect to Azure and register the cluster. |
75-
| `https://<region>.dp.kubernetesconfiguration.azure.cn` | Data plane endpoint for the agent to push status and fetch configuration information. |
76-
| `https://login.chinacloudapi.cn`<br/>`https://<region>.login.chinacloudapi.cn`<br/>`login.partner.microsoftonline.cn`| Required to fetch and update Azure Resource Manager tokens. |
77-
| `mcr.azk8s.cn` | Required to pull container images for Azure Arc agents. |
78-
| `https://gbl.his.arc.azure.cn` | Required to get the regional endpoint for pulling system-assigned Managed Identity certificates. |
79-
| `https://*.his.arc.azure.cn` | Required to pull system-assigned Managed Identity certificates. |
80-
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
81-
|`guestnotificationservice.azure.cn`<br/>`*.guestnotificationservice.azure.cn`<br/>`sts.chinacloudapi.cn`<br/>`https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
82-
|`*.servicebus.chinacloudapi.cn` | For [Cluster Connect](../cluster-connect.md) and for [Custom Location](../custom-locations.md) based scenarios. |
83-
|`https://graph.chinacloudapi.cn/` | Required when [Azure RBAC](../azure-rbac.md) is configured. |
84-
|`*.arc.azure.cn` | Required to manage connected clusters in Azure portal.|
85-
|`https://<region>.obo.arc.azure.cn:8084/` | Required when [Cluster Connect](../cluster-connect.md) is configured. |
86-
|`dl.k8s.io`| Required when [automatic agent upgrade](../agent-upgrade.md#toggle-automatic-upgrade-on-or-off-when-connecting-a-cluster-to-azure-arc) is enabled. |
87-
|`quay.azk8s.cn`<br/>`registryk8s.azk8s.cn`<br/>`k8sgcr.azk8s.cn`<br/>`usgcr.azk8s.cn`<br/>`dockerhub.azk8s.cn/<repo-name>/<image-name>:<version>`|Container registry proxy servers for Azure China VMs.|
17+
[!INCLUDE [network-requirements-azure-china.md](network-requirements-azure-china.md)]

‎articles/azure-arc/network-requirements-consolidated.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ Connectivity to the Arc Kubernetes-based endpoints is required for all Kubernete
1919
- Azure Arc-enabled App services
2020
- Azure Arc-enabled Machine Learning
2121
- Azure Arc-enabled data services (direct connectivity mode only)
22+
- Azure Arc resource bridge
2223

2324
[!INCLUDE [network-requirements](kubernetes/includes/network-requirements.md)]
2425

‎articles/azure-arc/resource-bridge/includes/network-requirements.md

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
ms.topic: include
3-
ms.date: 06/02/2023
3+
ms.date: 02/15/2024
44
---
55

66
### Outbound connectivity
@@ -9,9 +9,6 @@ The firewall and proxy URLs below must be allowlisted in order to enable communi
99

1010
### Firewall/Proxy URL allowlist
1111

12-
>[!Note]
13-
>To configure SSL proxy and to view the exclusion list for no proxy, see [Additional network requirements](/azure/azure-arc/resource-bridge/network-requirements#additional-network-requirements).
14-
1512
|**Service**|**Port**|**URL**|**Direction**|**Notes**|
1613
|--|--|--|--|--|
1714
|SFS API endpoint | 443 | `msk8s.api.cdp.microsoft.com` | Management machine & Appliance VM IPs need outbound connection. | Download product catalog, product bits, and OS images from SFS. |
@@ -31,4 +28,4 @@ The firewall and proxy URLs below must be allowlisted in order to enable communi
3128
|Python package| 443 | `*.pypi.org`| Management machine needs outbound connection. | Validate Kubernetes and Python versions.|
3229
|Azure CLI| 443 | `*.pythonhosted.org`| Management machine needs outbound connection. | Python packages for Azure CLI installation.|
3330
|Diagnostic data | 443 | `gcs.prod.monitoring.core.windows.net` | Appliance VM IPs need outbound connection. | Periodically sends Microsoft required diagnostic data. |
34-
|Windows NTP Server| 123 | `time.windows.com` | Appliance VM & Management machine (if HyperV default is Windows NTP) need outbound connection on UDP | OS time sync in appliance VM & Management machine (Windows NTP).|
31+
|Windows NTP Server| 123 | `time.windows.com` | Appliance VM & Management machine (if Hyper-V default is Windows NTP) need outbound connection on UDP | OS time sync in appliance VM & Management machine (Windows NTP).|

‎articles/azure-arc/resource-bridge/network-requirements.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Azure Arc resource bridge network requirements
33
description: Learn about network requirements for Azure Arc resource bridge including URLs that must be allowlisted.
44
ms.topic: conceptual
5-
ms.date: 11/03/2023
5+
ms.date: 02/15/2024
66
---
77

88
# Azure Arc resource bridge network requirements
@@ -17,9 +17,9 @@ Arc resource bridge communicates outbound securely to Azure Arc over TCP port 44
1717

1818
[!INCLUDE [network-requirements](includes/network-requirements.md)]
1919

20-
## Additional network requirements
20+
In addition, Arc resource bridge requires connectivity to the Arc-enabled Kubernetes endpoints shown here.
2121

22-
In addition, Arc resource bridge requires connectivity to the [Arc-enabled Kubernetes endpoints](../network-requirements-consolidated.md?tabs=azure-cloud).
22+
[!INCLUDE [network-requirements-azure-cloud](../kubernetes/includes/network-requirements-azure-cloud.md)]
2323

2424
> [!NOTE]
2525
> The URLs listed here are required for Arc resource bridge only. Other Arc products (such as Arc-enabled VMware vSphere) may have additional required URLs. For details, see [Azure Arc network requirements](../network-requirements-consolidated.md).

0 commit comments

Comments
 (0)