Skip to content

Commit 7dfdbab

Browse files
paigecalvertpaigecalvert
committed
split up the firewalls table
1 parent 27ae9b6 commit 7dfdbab

10 files changed

+136
-35
lines changed

‎docs/enterprise/installing-embedded-requirements.mdx‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import EmbeddedClusterRequirements from "../partials/embedded-cluster/_requirements.mdx"
22
import EmbeddedClusterPortRequirements from "../partials/embedded-cluster/_port-reqs.mdx"
3-
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
3+
import FirewallOpenings from "../partials/install/_firewall-openings-ec.mdx"
4+
import FirewallOpeningsIntro from "../partials/install/_firewall-openings-intro.mdx"
45

56
# Embedded Cluster Installation Requirements
67

@@ -16,4 +17,6 @@ This topic lists the installation requirements for Replicated Embedded Cluster.
1617

1718
## Firewall Openings for Online Installations
1819

20+
<FirewallOpeningsIntro/>
21+
1922
<FirewallOpenings/>

‎docs/enterprise/installing-general-requirements.mdx‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import DockerCompatibility from "../partials/image-registry/_docker-compatibility.mdx"
22
import KubernetesCompatibility from "../partials/install/_kubernetes-compatibility.mdx"
3-
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
3+
import FirewallOpenings from "../partials/install/_firewall-openings-kots.mdx"
4+
import FirewallOpeningsIntro from "../partials/install/_firewall-openings-intro.mdx"
45

56
# KOTS Installation Requirements
67

@@ -268,4 +269,6 @@ KOTS has been tested for compatibility with the following registries:
268269

269270
## Firewall Openings for Online Installations
270271

272+
<FirewallOpeningsIntro/>
273+
271274
<FirewallOpenings/>

‎docs/enterprise/installing-kurl-requirements.mdx‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
1+
import FirewallOpenings from "../partials/install/_firewall-openings-kurl.mdx"
2+
import FirewallOpeningsIntro from "../partials/install/_firewall-openings-intro.mdx"
23

34
# kURL Installation Requirements
45

@@ -35,4 +36,6 @@ You must meet the additional kURL system requirements when applicable:
3536

3637
## Firewall Openings for Online Installations
3738

39+
<FirewallOpeningsIntro/>
40+
3841
<FirewallOpenings/>

‎docs/partials/install/_firewall-openings-ec.mdx‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<table>
2+
<tr>
3+
<th width="50%">Domain</th>
4+
<th>Description</th>
5+
</tr>
6+
<tr>
7+
<td>`proxy.replicated.com`</td>
8+
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
9+
</tr>
10+
<tr>
11+
<td>`replicated.app`</td>
12+
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
13+
</tr>
14+
<tr>
15+
<td>`registry.replicated.com` &#42;</td>
16+
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
17+
</tr>
18+
</table>
19+
20+
&#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).

‎docs/partials/install/_firewall-openings-helm.mdx‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<table>
2+
<tr>
3+
<th width="50%">Domain</th>
4+
<th>Description</th>
5+
</tr>
6+
<tr>
7+
<td>`replicated.app` &#42;</td>
8+
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
9+
</tr>
10+
<tr>
11+
<td>`registry.replicated.com`</td>
12+
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
13+
</tr>
14+
<tr>
15+
<td>`proxy.replicated.com`</td>
16+
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
17+
</tr>
18+
</table>
19+
20+
&#42; Required only if the [Replicated SDK](/vendor/replicated-sdk-overview) if included as a dependency of the application Helm chart.

‎docs/partials/install/_firewall-openings-intro.mdx‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
The domains for the services listed in the table below need to be accessible from servers performing online installations. No outbound internet access is required for air gap installations.
2+
3+
For services hosted at domains owned by Replicated, the table below includes a link to the list of IP addresses for the domain at [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json) in GitHub. Note that the IP addresses listed in the `replicatedhq/ips` repository also include IP addresses for some domains that are _not_ required for installation.
4+
5+
For any third-party services hosted at domains not owned by Replicated, consult the third-party's documentation for the IP address range for each domain, as needed.

‎docs/partials/install/_firewall-openings-kots.mdx‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<table>
2+
<tr>
3+
<th width="50%">Domain</th>
4+
<th>Description</th>
5+
</tr>
6+
<tr>
7+
<td>Docker Hub</td>
8+
<td><p>Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are `index.docker.io`, `cdn.auth0.com`, `*.docker.io`, and `*.docker.com.`</p></td>
9+
</tr>
10+
<tr>
11+
<td>`proxy.replicated.com` &#42;</td>
12+
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
13+
</tr>
14+
<tr>
15+
<td>`replicated.app`</td>
16+
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
17+
</tr>
18+
<tr>
19+
<td>`registry.replicated.com` &#42;&#42;</td>
20+
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
21+
</tr>
22+
<tr>
23+
<td>`kots.io`</td>
24+
<td><p>Requests are made to this domain when installing the Replicated KOTS CLI. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p></td>
25+
</tr>
26+
<tr>
27+
<td>`github.com`</td>
28+
<td>Requests are made to this domain when installing the Replicated KOTS CLI. For information about retrieving GitHub IP addresses, see [About GitHub&#39;s IP addresses](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-githubs-ip-addresses) in the GitHub documentation.</td>
29+
</tr>
30+
</table>
31+
32+
&#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).
33+
34+
&#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).

‎docs/partials/install/_firewall-openings-kurl.mdx‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<table>
2+
<tr>
3+
<th width="50%">Domain</th>
4+
<th>Description</th>
5+
</tr>
6+
<tr>
7+
<td>Docker Hub</td>
8+
<td><p>Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are `index.docker.io`, `cdn.auth0.com`, `*.docker.io`, and `*.docker.com.`</p></td>
9+
</tr>
10+
<tr>
11+
<td>`proxy.replicated.com` &#42;</td>
12+
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
13+
</tr>
14+
<tr>
15+
<td>`replicated.app`</td>
16+
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
17+
</tr>
18+
<tr>
19+
<td>`registry.replicated.com` &#42;&#42;</td>
20+
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
21+
</tr>
22+
<tr>
23+
<td><p>`k8s.kurl.sh`</p><p>`s3.kurl.sh`</p></td>
24+
<td><p>kURL installation scripts and artifacts are served from [kurl.sh](https://kurl.sh). An application identifier is sent in a URL path, and bash scripts and binary executables are served from kurl.sh. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `k8s.kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L34-L39) in GitHub.</p><p> The range of IP addresses for `s3.kurl.sh` are the same as IP addresses for the `kurl.sh` domain. For the range of IP address for `kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L28-L31) in GitHub.</p></td>
25+
</tr>
26+
<tr>
27+
<td>`amazonaws.com`</td>
28+
<td>`tar.gz` packages are downloaded from Amazon S3 during installations with kURL. For information about dynamically scraping the IP ranges to allowlist for accessing these packages, see [AWS IP address ranges](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-download) in the AWS documentation.</td>
29+
</tr>
30+
</table>
31+
32+
&#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).
33+
34+
&#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).

‎docs/partials/install/_firewall-openings.mdx‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ For third-party services hosted at domains not owned by Replicated, the table be
5454
<td>Requests are made to this domain when installing the Replicated KOTS CLI. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</td>
5555
</tr>
5656
<tr>
57-
<td>`github.com `</td>
57+
<td>`github.com`</td>
5858
<td>Not Required</td>
5959
<td>Not Required</td>
6060
<td>Required</td>
@@ -79,8 +79,8 @@ For third-party services hosted at domains not owned by Replicated, the table be
7979
</tr>
8080
</table>
8181

82-
&#42; Required only if the application uses the Replicated proxy registry. Contact your software vendor for more information.
82+
&#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).
8383

84-
&#42;&#42; Required only if the application uses the Replicated registry. Contact your software vendor for more information.
84+
&#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).
8585

86-
&#42;&#42;&#42; Required only if the Replicated SDK if included as a dependency of the application Helm chart. For more information, see [About the Replicated SDK](/vendor/replicated-sdk-overview).
86+
&#42;&#42;&#42; Required only if the [Replicated SDK](/vendor/replicated-sdk-overview) if included as a dependency of the application Helm chart.

‎docs/vendor/install-with-helm.mdx‎

Lines changed: 7 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
import Prerequisites from "../partials/helm/_helm-install-prereqs.mdx"
2+
import FirewallOpenings from "../partials/install/_firewall-openings-helm.mdx"
3+
import FirewallOpeningsIntro from "../partials/install/_firewall-openings-intro.mdx"
24

35
# Installing with Helm
46

@@ -10,34 +12,11 @@ Before you install, complete the following prerequisites:
1012

1113
<Prerequisites/>
1214

13-
## Firewall Openings Requirements
14-
15-
The domains for the services listed below need to be accessible from servers performing online (internet-connected) installations:
16-
17-
:::note
18-
No outbound internet access is required for air gap installations.
19-
:::
20-
21-
<table>
22-
<tr>
23-
<th>Domain</th>
24-
<th>Description</th>
25-
</tr>
26-
<tr>
27-
<td>`proxy.replicated.com`</td>
28-
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
29-
</tr>
30-
<tr>
31-
<td>`registry.replicated.com` </td>
32-
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
33-
</tr>
34-
<tr>
35-
<td>`replicated.app` &#42;</td>
36-
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
37-
</tr>
38-
</table>
39-
40-
&#42; Required only if the Replicated SDK if included as a dependency of the application Helm chart. For more information, see [About the Replicated SDK](/vendor/replicated-sdk-overview).
15+
## Firewall Openings for Online Installations
16+
17+
<FirewallOpeningsIntro/>
18+
19+
<FirewallOpenings/>
4120

4221
## Install
4322

0 commit comments

Comments
 (0)