Merge pull request #17878 from v-sissondan/gw-endpoints-cristian

Arc GW endpoints for images (Cristian)

Author: v-dirichards

azure-local/deploy/deployment-azure-arc-gateway-overview.md

@@ -3,7 +3,7 @@ title: Overview of Azure Arc gateway for Azure Local, version 23H2 (preview)
 description: Learn what is Azure Arc gateway for Azure Local, version 23H2 (preview). 
 author: alkohli
 ms.topic: how-to
-ms.date: 04/23/2025
+ms.date: 05/08/2025
 ms.author: alkohli
 ms.service: azure-local
 ---
@@ -42,19 +42,19 @@ When Arc gateway is used, the *http* and *https* traffic flow changes as follows
 
 1. Based on the configuration in the Arc gateway, if allowed, the traffic is sent to target services. If not allowed, Arc proxy redirects this traffic to the enterprise proxy (or direct outbound if no proxy set). Arc proxy automatically determines the right path for the endpoint.
 
-**Traffic flow for Arc appliance Arc Resource Bridge (ARB) and AKS control plane**
+**Traffic flow for Arc appliance Azure Arc resource bridge and AKS control plane**
 
-1. The routable IP (failover clustered IP resource as of now) is used to forward the traffic through Arc proxy running on the Azure Local host machines.
+1. Routable IP (failover clustered IP resource as of now) is used to forward the traffic through Arc proxy running on the Azure Local host machines.
 
-1. ARB and AKS forward proxy are configured to use the routable IP.
+1. Azure Arc resource bridge and Azure Kubernetes Service (AKS) forward proxy are configured to use routable IP.
 
-1. With the proxy settings in place, ARB, and AKS outbound traffic is forwarded to Arc Proxy running on one of the Azure Local machines over the routable IP.
+1. With proxy settings in place, Arc resource bridge, and AKS outbound traffic is forwarded to Arc Proxy running on one of the Azure Local machines over routable IP.
 
-1. Once the traffic reaches Arc proxy, the remaining flow takes the same path as described. If traffic to the target service is allowed, it is sent to Arc gateway. If not, it is sent to the enterprise proxy (or direct outbound if no proxy set). For AKS specifically, this path is used for downloading docker images for Arc Agentry and Arc Extension Pods.
+1. When traffic reaches the Arc proxy, the remaining flow takes the same path as described. If traffic to the target service is allowed, it is sent to Arc gateway. If not, it's sent to the enterprise proxy (or direct outbound if no proxy set). For AKS specifically, this path is used for downloading docker images for Arc Agentry and Arc Extension Pods.
 
 **Traffic flow for Azure Local VMs**
 
-*Http* and *https* traffic are forwarded to the enterprise proxy. Arc proxy inside an Azure Local VM enabled by Arc is not yet supported in this version.
+HTTP and HTTPS traffic are forwarded to the enterprise proxy. Arc proxy inside an Azure Local virtual machine (VM) enabled by Arc is not yet supported in this version.
 
 Traffic flows are illustrated in the following diagram:
 
@@ -81,50 +81,52 @@ The list of supported endpoints by the Arc gateway in Azure Local will increase
 You can use the Arc gateway in the following scenario for Azure Local versions 2411.1 or later:
 
 - Enable Arc gateway during deployment of new Azure Local instances running versions 2411.1 or later.
-- The Arc gateway resource must be created on the same subscription where you are planning to deploy your Azure Local instance.
+- The Arc gateway resource must be created on the same subscription where you're planning to deploy your Azure Local instance.
 
 Unsupported scenarios for Azure Local include:
 
-- Enabling Arc gateway after deployment is not supported.
+- Enabling Arc gateway after deployment isn't supported.
 
 ## Azure Local endpoints not redirected
 
 The endpoints from the table are required and must be allowlisted in your proxy or firewall to deploy the Azure Local instance:
 
 | Endpoint # | Required endpoint | Component  |
 | -- | -- | -- |
-| 1 | `http://login.microsoftonline.com:443` | Arc registration |
-| 2 | `http://<region>.login.microsoft.com:443` | Arc registration |
-| 3 | `http://management.azure.com:443` | Arc registration |
-| 4 | `http://gbl.his.arc.azure.com:443` | Arc registration |  
-| 5 | `http://<region>.his.arc.azure.com:443` | Arc registration |
-| 6 | `http://dc.services.visualstudio.com:443` | Arc registration |
-| 7 | `https://<region>.obo.arc.azure.com:8084` | AKS extensions |
-| 8 | `http://<yourarcgatewayId>.gw.arc.azure.com:443` | Arc gateway |
-| 9 | `http://<yourkeyvaultname>.vault.azure.net:443` | Azure Key Vault |
-| 10 | `http://<yourblobstorageforcloudwitnessname>.blob.core.windows.net:443` | Cloud Witness Storage Account |
-| 11 | `http://files.pythonhosted.org:443` | Not required starting with 2504 new deployments. Microsoft On-premises Cloud/ARB/AKS |
-| 12 | `http://pypi.org:443` | Not required starting with 2504 new deployments. Microsoft On-premises Cloud/ARB/AKS |
-| 13 | `http://raw.githubusercontent.com:443` | Not required starting with 2504 new deployments. Microsoft On-premises Cloud/ARB/AKS |
-| 14 | `http://pythonhosted.org:443` | Not required starting with 2504 new deployments. Microsoft On-premises Cloud/ARB/AKS |
-| 15 | `http://ocsp.digicert.com`  | Certificate Revocation List for Arc extensions |
-| 16 | `http://s.symcd.com` | Certificate Revocation List for Arc extensions |
-| 17 | `http://ts-ocsp.ws.symantec.com` | Certificate Revocation List for Arc extensions |
-| 18 | `http://ocsp.globalsign.com` | Certificate Revocation List for Arc extensions |
-| 19 | `http://ocsp2.globalsign.com` | Certificate Revocation List for Arc extensions |
-| 20 | `http://oneocsp.microsoft.com` | Certificate Revocation List for Arc extensions |
-| 21 | `http://crl.microsoft.com/pkiinfra` | Certificate Revocation List for Arc extensions |
-| 22 | `http://dl.delivery.mp.microsoft.com` | Windows Update |
-| 23 | `http://*.tlu.dl.delivery.mp.microsoft.com` | Windows Update |
-| 24 | `http://*.windowsupdate.com` | Windows Update |
-| 25 | `http://*.windowsupdate.microsoft.com` | Windows Update |
-| 26 | `http://*.update.microsoft.com` | Windows Update |
+| 1 | `http://aka.ms:443` | Bootstrap |
+| 2 | `http://azurestackreleases.download.prss.microsoft.com:443]` | Bootstrap |
+| 3 | `http://login.microsoftonline.com:443` | Arc registration |
+| 4 | `http://<region>.login.microsoft.com:443` | Arc registration |
+| 5 | `http://management.azure.com:443` | Arc registration |
+| 6 | `http://gbl.his.arc.azure.com:443` | Arc registration |  
+| 7 | `http://<region>.his.arc.azure.com:443` | Arc registration |
+| 8 | `http://dc.services.visualstudio.com:443` | Arc registration |
+| 9 | `https://<region>.obo.arc.azure.com:8084` | AKS extensions |
+| 10 | `http://<yourarcgatewayId>.gw.arc.azure.com:443` | Arc gateway |
+| 11 | `http://<yourkeyvaultname>.vault.azure.net:443` | Azure Key Vault |
+| 12 | `http://<yourblobstorageforcloudwitnessname>.blob.core.windows.net:443` | Cloud Witness Storage Account |
+| 13 | `http://files.pythonhosted.org:443` | Not required starting with 2504 new deployments. Microsoft On-premises Cloud/ARB/AKS |
+| 14 | `http://pypi.org:443` | Not required starting with 2504 new deployments. Microsoft On-premises Cloud/ARB/AKS |
+| 15 | `http://raw.githubusercontent.com:443` | Not required starting with 2504 new deployments. Microsoft On-premises Cloud/ARB/AKS |
+| 16 | `http://pythonhosted.org:443` | Not required starting with 2504 new deployments. Microsoft On-premises Cloud/ARB/AKS |
+| 17 | `http://ocsp.digicert.com`  | Certificate Revocation List for Arc extensions |
+| 18 | `http://s.symcd.com` | Certificate Revocation List for Arc extensions |
+| 19 | `http://ts-ocsp.ws.symantec.com` | Certificate Revocation List for Arc extensions |
+| 20 | `http://ocsp.globalsign.com` | Certificate Revocation List for Arc extensions |
+| 21 | `http://ocsp2.globalsign.com` | Certificate Revocation List for Arc extensions |
+| 22 | `http://oneocsp.microsoft.com` | Certificate Revocation List for Arc extensions |
+| 23 | `http://crl.microsoft.com/pkiinfra` | Certificate Revocation List for Arc extensions |
+| 24 | `http://dl.delivery.mp.microsoft.com` | Windows Update |
+| 25 | `http://*.tlu.dl.delivery.mp.microsoft.com` | Windows Update |
+| 26 | `http://*.windowsupdate.com` | Windows Update |
+| 27 | `http://*.windowsupdate.microsoft.com` | Windows Update |
+| 28 | `http://*.update.microsoft.com` | Windows Update |
 
 ## Restrictions and limitations
 
 Consider the following limitations of Arc gateway in this release:
 
-- TLS terminating proxies aren't supported with the Arc gateway preview.
+- Transport Layer Security (TLS) terminating proxies aren't supported with the Arc gateway preview.
 - Use of ExpressRoute, Site-to-Site VPN, or Private Endpoints in addition to the Arc gateway (preview) isn't supported.  
 
 ## Create the Arc gateway resource in Azure
@@ -135,7 +137,7 @@ You can create an Arc gateway resource using the Azure portal, Azure CLI, or Azu
 
 1. Sign in to [Azure portal](https://ms.portal.azure.com/).
 1. Go to the **Azure Arc > Azure Arc gateway** page, then select **Create**.
-1. Select the subscription where you are planning to deploy your Azure Local instance.
+1. Select the subscription where you're planning to deploy your Azure Local instance.
 1. For **Name**, enter the name for the Arc gateway resource.
 1. For **Location**, enter the region where the Arc gateway resource should live. An Arc gateway resource is used by any Arc-enabled resource in the same Azure tenant.
 1. Select **Next**.
@@ -180,7 +182,7 @@ The gateway creation process takes 9-10 minutes to complete.
 
 ## Detach or change the Arc gateway association from the machine
 
-To detach the gateway resource from your Arc-enabled server, set the gateway resource ID to `null`. To attach your Arc-enabled server to another Arc gateway resource just update the name and resource ID with the new Arc gateway information:
+To detach the gateway resource from your Arc-enabled server, set the gateway resource ID to `null`. To attach your Arc-enabled server to another Arc gateway resource, update the name and resource ID with the new Arc gateway information:
 
 ```azurecli
 az arcgateway settings update --resource-group <Resource Group> --subscription <subscription name> --base-provider Microsoft.HybridCompute --base-resource-type machines --base-resource-name <Arc-enabled server name> --gateway-resource-id "