Merge pull request #31617 from skrthomas/BZ1886291

BZ1886291: Added ports and wildcard URL with note

Author: adellape

modules/configuring-firewall.adoc

@@ -13,103 +13,133 @@ There are no special configuration considerations for services running on only c
 
 . Allowlist the following registry URLs:
 +
-[cols="3,4",options="header"]
+[cols="3,2,4",options="header"]
 |===
-|URL | Function
+|URL | Port | Function
+
 |`registry.redhat.io`
+|443, 80
 |Provides core container images
 
 |`quay.io`
+|443 or 80
+|Provides core container images
+
+|`*.quay.io`
+|443, 80
 |Provides core container images
 
 |`sso.redhat.com`
+|443, 80
 |The `https://cloud.redhat.com/openshift` site uses authentication from `sso.redhat.com`
 
 |`openshift.org`
+|443, 80
 |Provides {op-system-first} images
+
 |===
 +
 When you add a site such as `quay.io` to your allowlist, do not add a wildcard entry such as `*.quay.io` to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, then image downloads are denied when the initial download request is redirected to a host name such as `cdn01.quay.io`.
++
+CDN host names, such as `cdn01.quay.io` are covered when you add a wildcard entry such as `*.quay.io` in your allowlist.
 
 . Allowlist any site that provides resources for a language or framework that your builds require.
 
 . If you do not disable Telemetry, you must grant access to the following URLs to access Red Hat Insights:
 +
-[cols="3,4",options="header"]
+[cols="3,2,4",options="header"]
 |===
-|URL | Function
+|URL | Port | Function
 
 |`cert-api.access.redhat.com`
+|443, 80
 |Required for Telemetry
 
 |`api.access.redhat.com`
+|443, 80
 |Required for Telemetry
 
 |`infogw.api.openshift.com`
+|443, 80
 |Required for Telemetry
 
 |`https://cloud.redhat.com/api/ingress`
+|443, 80
 |Required for Telemetry and for `insights-operator`
 |===
 
 . If you use Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) to host your cluster, you must grant access to the URLs that provide the cloud provider API and DNS for that cloud:
 +
-[cols="2a,8a,8a",options="header"]
+[cols="2a,8a,2a,8a",options="header"]
 |===
-|Cloud |URL |Function
+|Cloud |URL | Port |Function
 
 .2+|AWS
 |`*.amazonaws.com`
+|443, 80
 |Required to access AWS services and resources. Review the link:https://docs.aws.amazon.com/general/latest/gr/rande.html[AWS Service Endpoints] in the AWS documentation to determine the exact endpoints to allow for the regions that you use.
 
 |`oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com`
+|443, 80
 |Required to access AWS services and resources when using strict security requirements. Review the link:https://docs.aws.amazon.com/general/latest/gr/rande.html[AWS Service Endpoints] in the AWS documentation to determine the exact endpoints to allow for the regions that you use.
 
 .2+|GCP
 |`*.googleapis.com`
+|443, 80
 |Required to access GCP services and resources. Review link:https://cloud.google.com/endpoints/[Cloud Endpoints] in the GCP documentation to determine the endpoints to allow for your APIs.
 
 |`accounts.google.com`
+|443, 80
 | Required to access your GCP account.
 
 |Azure
 |`management.azure.com`
+|443, 80
 |Required to access Azure services and resources. Review the link:https://docs.microsoft.com/en-us/rest/api/azure/[Azure REST API Reference] in the Azure documentation to determine the endpoints to allow for your APIs.
 
 |===
 
 . Allowlist the following URLs:
 +
-[cols="3,4",options="header"]
+[cols="3,2,4",options="header"]
 |===
-|URL | Function
+|URL | Port | Function
 
 |`mirror.openshift.com`
+|443, 80
 |Required to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
 
 |`storage.googleapis.com/openshift-release`
+|443, 80
 |A source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
 
 |`*.apps.<cluster_name>.<base_domain>`
+|443, 80
 |Required to access the default cluster routes unless you set an ingress wildcard during installation.
 
 |`quay-registry.s3.amazonaws.com`
+|443, 80
 |Required to access Quay image content in AWS.
 
 |`api.openshift.com`
+|443, 80
 |Required to check if updates are available for the cluster.
 
 |`art-rhcos-ci.s3.amazonaws.com`
+|443, 80
 |Required to download {op-system-first} images.
 
 |`api.openshift.com`
+|443, 80
 |Required for your cluster token.
 
 |`cloud.redhat.com/openshift`
+|443, 80
 |Required for your cluster token.
 
 |`registry.access.redhat.com`
-|Required for `odo` CLI. 
+|443, 80
+|Required for `odo` CLI.
 |===
 +
 Operators require route access to perform health checks. Specifically, the