Merge pull request #28024 from mikemckiernan/fix/allowlist-cdn

BZ#1874098: image reg, cdn, and firewalls

Author: bmcelvee

modules/configuring-firewall.adoc

@@ -28,6 +28,8 @@ There are no special configuration considerations for services running on only c
 |`openshift.org`
 |Provides {op-system-first} images
 |===
++
+When you add a site such as `quay.io` to your allowlist, do not add a wildcard entry such as `*.quay.io` to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, then image downloads are denied when the initial download request is redirected to a host name such as `cdn01.quay.io`.
 
 . Allowlist any site that provides resources for a language or framework that your builds require.
 
@@ -107,7 +109,7 @@ There are no special configuration considerations for services running on only c
 |Required for your cluster token.
 
 |`registry.access.redhat.com`
-|Required for `odo` CLI . 
+|Required for `odo` CLI. 
 |===
 +
 Operators require route access to perform health checks. Specifically, the