Skip to content

Commit 7f32e34

Browse files
mletaliemletalie
committed
firewall prereqs PSC
1 parent eb3568f commit 7f32e34

File tree

5 files changed

+243
-7
lines changed

5 files changed

+243
-7
lines changed

‎_topic_maps/_topic_map_osd.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -369,8 +369,8 @@ Distros: openshift-dedicated
369369
Topics:
370370
- Name: Viewing audit logs
371371
File: audit-log-view
372-
- Name: Required allowlist IP addresses for SRE cluster access
373-
File: rh-required-whitelisted-IP-addresses-for-sre-access
372+
# - Name: Required allowlist IP addresses for SRE cluster access
373+
# File: rh-required-whitelisted-IP-addresses-for-sre-access
374374
---
375375
Name: Authentication and authorization
376376
Dir: authentication

‎modules/ccs-gcp-customer-requirements.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,11 @@ This policy only provides Red Hat with permissions and capabilities to change re
6262

6363
* Volume snapshots will remain within the customer-provided GCP account and customer-specified region.
6464

65-
* Red Hat must have ingress access to the API server through allowlist IP addresses.
65+
* To manage, monitor, and troubleshoot {product-title} clusters, Red Hat must have direct access to the cluster's API server. You must not restrict or otherwise prevent Red Hat's access to the {product-title} cluster's API server.
6666
+
6767
[NOTE]
6868
====
69-
For information about allowlist IP addresses, see Additional resources.
69+
SRE uses various methods to access clusters, depending on network configuration. Access to private clusters is restricted to Red Hat trusted IP addresses only. These access restrictions are managed automatically by Red Hat.
7070
====
7171
+
72-
* Red Hat must have egress allowed to forward system and audit logs to a Red Hat managed central logging stack.
72+
* {product-title} requires egress access to certain endpoints over the internet. Only clusters deployed with Private Service Connect can use a firewall to control egress traffic. For additional information, see the _GCP firewall prerequisites_ section.

‎modules/osd-aws-privatelink-firewall-prerequisites.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ endif::[]
9595

9696
|`access.redhat.com`
9797
|443
98-
|Required. Hosts a signature store that a container client requires for verifying images when pulling them from `registry.access.redhat.com`.
98+
|Required. Hosts a signature store that a container client requires for verifying images when pulling them from `registry.access.redhat.com`.
9999

100100
|`registry.connect.redhat.com`
101101
|443

‎modules/osd-gcp-psc-firewall-prerequisites.adoc

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * osd_planning/gcp-ccs.adoc
4+
5+
6+
[id="osd-gcp-psc-firewall-prerequisites_{context}"]
7+
= GCP firewall prerequisites
8+
9+
If you are using a firewall to control egress traffic from {product-title} on {GCP}, you must configure your firewall to grant access to certain domains and port combinations listed in the tables below. {product-title} requires this access to provide a fully managed OpenShift service.
10+
11+
[IMPORTANT]
12+
====
13+
Only {product-title} on {GCP} clusters deployed with Private Service Connect can use a firewall to control egress traffic.
14+
====
15+
16+
// .Prerequisites
17+
// Per SMEs, no prereqs. Will confirm with QE when ticket is reviewed.
18+
19+
.Procedure
20+
21+
. Add the following URLs that are used to install and download packages and tools to an allowlist:
22+
+
23+
[cols="6,1,6",options="header"]
24+
|===
25+
|Domain | Port | Function
26+
|`registry.redhat.io`
27+
|443
28+
|Provides core container images.
29+
30+
|`quay.io`
31+
|443
32+
|Provides core container images.
33+
34+
|`cdn01.quay.io`
35+
36+
`cdn02.quay.io`
37+
38+
`cdn03.quay.io`
39+
40+
`cdn04.quay.io`
41+
42+
`cdn05.quay.io`
43+
44+
`cdn06.quay.io`
45+
46+
|443
47+
|Provides core container images.
48+
49+
|`sso.redhat.com`
50+
|443
51+
|Required. The https://console.redhat.com/openshift site uses authentication from sso.redhat.com to download the pull secret and use Red Hat SaaS solutions to facilitate monitoring of your subscriptions, cluster inventory, chargeback reporting, and so on.
52+
53+
|`quayio-production-s3.s3.amazonaws.com`
54+
|443
55+
|Provides core container images.
56+
57+
|`pull.q1w2.quay.rhcloud.com`
58+
|443
59+
|Provides core container images.
60+
61+
|`registry.access.redhat.com`
62+
|443
63+
|Hosts all the container images that are stored on the Red{nbsp}Hat Ecosytem Catalog. Additionally, the registry provides access to the `odo` CLI tool that helps developers build on OpenShift and Kubernetes.
64+
65+
|`registry.connect.redhat.com`
66+
|443
67+
|Required for all third-party images and certified Operators.
68+
69+
|`console.redhat.com`
70+
|443
71+
|Required. Allows interactions between the cluster and {cluster-manager-first} to enable functionality, such as scheduling upgrades.
72+
73+
|`sso.redhat.com`
74+
|443
75+
|The `https://console.redhat.com/openshift` site uses authentication from `sso.redhat.com`.
76+
77+
|`catalog.redhat.com`
78+
|443
79+
|The `registry.access.redhat.com` and `https://registry.redhat.io` sites redirect through `catalog.redhat.com`.
80+
|===
81+
+
82+
. Add the following telemetry URLs to an allowlist:
83+
+
84+
[cols="6,1,6",options="header"]
85+
|===
86+
|Domain | Port | Function
87+
88+
|`cert-api.access.redhat.com`
89+
|443
90+
|Required for telemetry.
91+
92+
|`api.access.redhat.com`
93+
|443
94+
|Required for telemetry.
95+
96+
|`infogw.api.openshift.com`
97+
|443
98+
|Required for telemetry.
99+
100+
|`console.redhat.com`
101+
|443
102+
|Required for telemetry and Red{nbsp}Hat Insights.
103+
104+
|`observatorium-mst.api.openshift.com`
105+
|443
106+
|Required for managed OpenShift-specific telemetry.
107+
108+
|`observatorium.api.openshift.com`
109+
|443
110+
|Required for managed OpenShift-specific telemetry.
111+
|===
112+
+
113+
114+
[NOTE]
115+
====
116+
Managed clusters require the enabling of telemetry to allow Red Hat to react more quickly to problems, better support the customers, and better understand how product upgrades impact clusters. For more information about how remote health monitoring data is used by Red Hat, see _About remote health monitoring_ in the _Additional resources_ section.
117+
====
118+
119+
. Add the following {product-title} URLs to an allowlist:
120+
+
121+
[cols="6,1,6",options="header"]
122+
|===
123+
|Domain | Port | Function
124+
125+
|`mirror.openshift.com`
126+
|443
127+
|Used to access mirrored installation content and images. This site is also a source of release image signatures.
128+
129+
|`api.openshift.com`
130+
|443
131+
|Used to check if updates are available for the cluster.
132+
|===
133+
134+
. Add the following site reliability engineering (SRE) and management URLs to an allowlist:
135+
+
136+
[cols="6,1,6",options="header"]
137+
|===
138+
|Domain | Port | Function
139+
140+
|`api.pagerduty.com`
141+
|443
142+
|This alerting service is used by the in-cluster alertmanager to send alerts notifying Red{nbsp}Hat SRE of an event to take action on.
143+
144+
|`events.pagerduty.com`
145+
|443
146+
|This alerting service is used by the in-cluster alertmanager to send alerts notifying Red{nbsp}Hat SRE of an event to take action on.
147+
148+
|`api.deadmanssnitch.com`
149+
|443
150+
|Alerting service used by {product-title} to send periodic pings that indicate whether the cluster is available and running.
151+
152+
|`nosnch.in`
153+
|443
154+
|Alerting service used by {product-title} to send periodic pings that indicate whether the cluster is available and running.
155+
156+
|`*.osdsecuritylogs.splunkcloud.com`
157+
158+
OR
159+
160+
`inputs1.osdsecuritylogs.splunkcloud.com`
161+
162+
`inputs2.osdsecuritylogs.splunkcloud.com`
163+
164+
`inputs4.osdsecuritylogs.splunkcloud.com`
165+
166+
`inputs5.osdsecuritylogs.splunkcloud.com`
167+
168+
`inputs6.osdsecuritylogs.splunkcloud.com`
169+
170+
`inputs7.osdsecuritylogs.splunkcloud.com`
171+
172+
`inputs8.osdsecuritylogs.splunkcloud.com`
173+
174+
`inputs9.osdsecuritylogs.splunkcloud.com`
175+
176+
`inputs10.osdsecuritylogs.splunkcloud.com`
177+
178+
`inputs11.osdsecuritylogs.splunkcloud.com`
179+
180+
`inputs12.osdsecuritylogs.splunkcloud.com`
181+
182+
`inputs13.osdsecuritylogs.splunkcloud.com`
183+
184+
`inputs14.osdsecuritylogs.splunkcloud.com`
185+
186+
`inputs15.osdsecuritylogs.splunkcloud.com`
187+
|9997
188+
|Used by the `splunk-forwarder-operator` as a logging forwarding endpoint to be used by Red{nbsp}Hat SRE for log-based alerting.
189+
190+
|`http-inputs-osdsecuritylogs.splunkcloud.com`
191+
|443
192+
|Used by the `splunk-forwarder-operator` as a logging forwarding endpoint to be used by Red{nbsp}Hat SRE for log-based alerting.
193+
194+
|`sftp.access.redhat.com` (Recommended)
195+
|22
196+
|The SFTP server used by `must-gather-operator` to upload diagnostic logs to help troubleshoot issues with the cluster.
197+
|===
198+
199+
. Add the following URLs for the {GCP} API endpoints to an allowlist:
200+
+
201+
[cols="6,1,6",options="header"]
202+
|===
203+
|Domain | Port | Function
204+
205+
| `accounts.google.com`
206+
| 443
207+
| Used to access your GCP account.
208+
209+
|`*.googleapis.com`
210+
211+
OR
212+
213+
`storage.googleapis.com`
214+
215+
`iam.googleapis.com`
216+
217+
`serviceusage.googleapis.com`
218+
219+
`cloudresourcemanager.googleapis.com`
220+
221+
`compute.googleapis.com`
222+
223+
`oauth2.googleapis.com`
224+
225+
`dns.googleapis.com`
226+
227+
`iamcredentials.googleapis.com`
228+
| 443
229+
| Used to access GCP services and resources. Review link:https://cloud.google.com/endpoints/docs[Cloud Endpoints] in the GCP documentation to determine the endpoints to allow for your APIs.
230+
|===
231+
+
232+
[NOTE]
233+
====
234+
Required Google APIs can be exposed using the link:https://cloud.google.com/vpc-service-controls/docs/restricted-vip-services[Private Google Access restricted virtual IP (VIP)], with the exception of the Service Usage API (serviceusage.googleapis.com). To circumvent this, you must expose the Service Usage API using the link:https://cloud.google.com/vpc/docs/configure-private-google-access#domain-options[Private Google Access private VIP].
235+
====

‎osd_planning/gcp-ccs.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,9 @@ include::modules/ccs-gcp-customer-procedure.adoc[leveloffset=+1]
1515
include::modules/ccs-gcp-iam.adoc[leveloffset=+1]
1616
include::modules/ccs-gcp-provisioned.adoc[leveloffset=+1]
1717
include::modules/gcp-limits.adoc[leveloffset=+1]
18+
include::modules/osd-gcp-psc-firewall-prerequisites.adoc[leveloffset=+1]
1819

1920
[id="additional-resources_{context}"]
2021
== Additional resources
2122

22-
* xref:../security/rh-required-whitelisted-IP-addresses-for-sre-access.adoc#rh-required-whitelisted-IP-addresses-for-sre-access[Required allowlist IP addresses for SRE access]
23+
* xref:../support/remote_health_monitoring/about-remote-health-monitoring.adoc#about-remote-health-monitoring[About remote health monitoring]

0 commit comments

Comments
 (0)