Skip to content

Commit c96703c

Browse files
paigecalvertpaigecalvert
authored
Merge pull request #2908 from replicatedhq/helm-cli-firewall-openings
Helm cli firewall openings
2 parents 4401731 + fa31f3b commit c96703c

File tree

6 files changed

+211
-23
lines changed

6 files changed

+211
-23
lines changed

‎docs/enterprise/installing-embedded-requirements.mdx‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import EmbeddedClusterRequirements from "../partials/embedded-cluster/_requirements.mdx"
22
import EmbeddedClusterPortRequirements from "../partials/embedded-cluster/_port-reqs.mdx"
3-
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
3+
import FirewallOpeningsIntro from "../partials/install/_firewall-openings-intro.mdx"
44

55
# Embedded Cluster Installation Requirements
66

@@ -14,6 +14,27 @@ This topic lists the installation requirements for Replicated Embedded Cluster.
1414

1515
<EmbeddedClusterPortRequirements/>
1616

17-
## Firewall Openings for Online Installations
18-
19-
<FirewallOpenings/>
17+
## Firewall Openings for Online Installations with Embedded Cluster {#firewall}
18+
19+
<FirewallOpeningsIntro/>
20+
21+
<table>
22+
<tr>
23+
<th width="50%">Domain</th>
24+
<th>Description</th>
25+
</tr>
26+
<tr>
27+
<td>`proxy.replicated.com`</td>
28+
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
29+
</tr>
30+
<tr>
31+
<td>`replicated.app`</td>
32+
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
33+
</tr>
34+
<tr>
35+
<td>`registry.replicated.com` &#42;</td>
36+
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
37+
</tr>
38+
</table>
39+
40+
&#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).

‎docs/enterprise/installing-general-requirements.mdx‎

Lines changed: 39 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import DockerCompatibility from "../partials/image-registry/_docker-compatibility.mdx"
22
import KubernetesCompatibility from "../partials/install/_kubernetes-compatibility.mdx"
3-
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
3+
import FirewallOpeningsIntro from "../partials/install/_firewall-openings-intro.mdx"
44

55
# KOTS Installation Requirements
66

@@ -266,6 +266,41 @@ KOTS has been tested for compatibility with the following registries:
266266

267267
<DockerCompatibility/>
268268

269-
## Firewall Openings for Online Installations
270-
271-
<FirewallOpenings/>
269+
## Firewall Openings for Online Installations with KOTS in an Existing Cluster {#firewall}
270+
271+
<FirewallOpeningsIntro/>
272+
273+
<table>
274+
<tr>
275+
<th width="50%">Domain</th>
276+
<th>Description</th>
277+
</tr>
278+
<tr>
279+
<td>Docker Hub</td>
280+
<td><p>Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are `index.docker.io`, `cdn.auth0.com`, `*.docker.io`, and `*.docker.com.`</p></td>
281+
</tr>
282+
<tr>
283+
<td>`proxy.replicated.com` &#42;</td>
284+
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
285+
</tr>
286+
<tr>
287+
<td>`replicated.app`</td>
288+
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
289+
</tr>
290+
<tr>
291+
<td>`registry.replicated.com` &#42;&#42;</td>
292+
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
293+
</tr>
294+
<tr>
295+
<td>`kots.io`</td>
296+
<td><p>Requests are made to this domain when installing the Replicated KOTS CLI. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p></td>
297+
</tr>
298+
<tr>
299+
<td>`github.com`</td>
300+
<td>Requests are made to this domain when installing the Replicated KOTS CLI. For information about retrieving GitHub IP addresses, see [About GitHub&#39;s IP addresses](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-githubs-ip-addresses) in the GitHub documentation.</td>
301+
</tr>
302+
</table>
303+
304+
&#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).
305+
306+
&#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).

‎docs/enterprise/installing-kurl-requirements.mdx‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
1+
import FirewallOpeningsIntro from "../partials/install/_firewall-openings-intro.mdx"
22

33
# kURL Installation Requirements
44

@@ -33,6 +33,41 @@ You must meet the additional kURL system requirements when applicable:
3333

3434
- **Cloud Disk Performance**: For a list of cloud VM instance and disk combinations that are known to provide sufficient performance for etcd and pass the write latency preflight, see [Cloud Disk Performance](https://kurl.sh/docs/install-with-kurl/system-requirements#cloud-disk-performance) in the kURL documentation.
3535

36-
## Firewall Openings for Online Installations
36+
## Firewall Openings for Online Installations with kURL {#firewall}
3737

38-
<FirewallOpenings/>
38+
<FirewallOpeningsIntro/>
39+
40+
<table>
41+
<tr>
42+
<th width="50%">Domain</th>
43+
<th>Description</th>
44+
</tr>
45+
<tr>
46+
<td>Docker Hub</td>
47+
<td><p>Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are `index.docker.io`, `cdn.auth0.com`, `*.docker.io`, and `*.docker.com.`</p></td>
48+
</tr>
49+
<tr>
50+
<td>`proxy.replicated.com` &#42;</td>
51+
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
52+
</tr>
53+
<tr>
54+
<td>`replicated.app`</td>
55+
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
56+
</tr>
57+
<tr>
58+
<td>`registry.replicated.com` &#42;&#42;</td>
59+
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
60+
</tr>
61+
<tr>
62+
<td><p>`k8s.kurl.sh`</p><p>`s3.kurl.sh`</p></td>
63+
<td><p>kURL installation scripts and artifacts are served from [kurl.sh](https://kurl.sh). An application identifier is sent in a URL path, and bash scripts and binary executables are served from kurl.sh. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `k8s.kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L34-L39) in GitHub.</p><p> The range of IP addresses for `s3.kurl.sh` are the same as IP addresses for the `kurl.sh` domain. For the range of IP address for `kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L28-L31) in GitHub.</p></td>
64+
</tr>
65+
<tr>
66+
<td>`amazonaws.com`</td>
67+
<td>`tar.gz` packages are downloaded from Amazon S3 during installations with kURL. For information about dynamically scraping the IP ranges to allowlist for accessing these packages, see [AWS IP address ranges](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-download) in the AWS documentation.</td>
68+
</tr>
69+
</table>
70+
71+
&#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).
72+
73+
&#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).

‎docs/partials/install/_firewall-openings-intro.mdx‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
The domains for the services listed in the table below need to be accessible from servers performing online installations. No outbound internet access is required for air gap installations.
2+
3+
For services hosted at domains owned by Replicated, the table below includes a link to the list of IP addresses for the domain at [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json) in GitHub. Note that the IP addresses listed in the `replicatedhq/ips` repository also include IP addresses for some domains that are _not_ required for installation.
4+
5+
For any third-party services hosted at domains not owned by Replicated, consult the third-party's documentation for the IP address range for each domain, as needed.

‎docs/partials/install/_firewall-openings.mdx‎

Lines changed: 78 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,83 @@ For services hosted at domains owned by Replicated, the table below includes a l
44

55
For third-party services hosted at domains not owned by Replicated, the table below lists the required domains. Consult the third-party's documentation for the IP address range for each domain, as needed.
66

7-
| Host | Embedded Cluster | KOTS Existing Cluster | kURL Clusters | Description |
8-
|--------|------------------|-------------------|-------------------|-------------|
9-
| Docker Hub | Not Required | Required | Required | Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are `index.docker.io`, `cdn.auth0.com`, `*.docker.io`, and `*.docker.com.` |
10-
| `replicated.app` | Required | Required | Required | <p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p> <p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p> |
11-
| `proxy.replicated.com` | Required | Required&#42;| Required&#42;| <p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p> <p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p> |
12-
| `registry.replicated.com` | Required&#42;&#42; | Required&#42;&#42; | Required&#42;&#42; | <p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p>
13-
| `kots.io` | Not Required | Required | Not Required | Requests are made to this domain when installing the Replicated KOTS CLI. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.|
14-
| `github.com ` | Not Required | Required | Not Required | Requests are made to this domain when installing the Replicated KOTS CLI. For information about retrieving GitHub IP addresses, see [About GitHub's IP addresses](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-githubs-ip-addresses) in the GitHub documentation. |
15-
| `k8s.kurl.sh`<br/>`s3.kurl.sh` | Not Required | Not Required | Required | <p>kURL installation scripts and artifacts are served from [kurl.sh](https://kurl.sh). An application identifier is sent in a URL path, and bash scripts and binary executables are served from kurl.sh. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `k8s.kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L34-L39) in GitHub.</p><p> The range of IP addresses for `s3.kurl.sh` are the same as IP addresses for the `kurl.sh` domain. For the range of IP address for `kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L28-L31) in GitHub.</p> |
16-
| `amazonaws.com` | Not Required | Not Required | Required | `tar.gz` packages are downloaded from Amazon S3 during installations with kURL. For information about dynamically scraping the IP ranges to allowlist for accessing these packages, see [AWS IP address ranges](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-download) in the AWS documentation.|
7+
<table>
8+
<tr>
9+
<th width="10%">Host</th>
10+
<th width="20%">Embedded Cluster</th>
11+
<th width="20%">Helm</th>
12+
<th width="20%">KOTS Existing Cluster</th>
13+
<th width="20%">kURL</th>
14+
<th width="10%">Description</th>
15+
</tr>
16+
<tr>
17+
<td>Docker Hub</td>
18+
<td>Not Required</td>
19+
<td>Not Required</td>
20+
<td>Required</td>
21+
<td>Required</td>
22+
<td>Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are `index.docker.io`, `cdn.auth0.com`, `*.docker.io`, and `*.docker.com.`</td>
23+
</tr>
24+
<tr>
25+
<td>`replicated.app`</td>
26+
<td>Required</td>
27+
<td>Required&#42;&#42;&#42;</td>
28+
<td>Required</td>
29+
<td>Required</td>
30+
<td><p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p></td>
31+
</tr>
32+
<tr>
33+
<td>`proxy.replicated.com`</td>
34+
<td>Required</td>
35+
<td>Required</td>
36+
<td>Required&#42;</td>
37+
<td>Required&#42;</td>
38+
<td><p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p></td>
39+
</tr>
40+
<tr>
41+
<td>`registry.replicated.com`</td>
42+
<td>Required&#42;&#42;</td>
43+
<td>Required</td>
44+
<td>Required&#42;&#42;</td>
45+
<td>Required&#42;&#42;</td>
46+
<td><p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p></td>
47+
</tr>
48+
<tr>
49+
<td>`kots.io`</td>
50+
<td>Not Required</td>
51+
<td>Not Required</td>
52+
<td>Required</td>
53+
<td>Not Required</td>
54+
<td>Requests are made to this domain when installing the Replicated KOTS CLI. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</td>
55+
</tr>
56+
<tr>
57+
<td>`github.com`</td>
58+
<td>Not Required</td>
59+
<td>Not Required</td>
60+
<td>Required</td>
61+
<td>Not Required</td>
62+
<td>Requests are made to this domain when installing the Replicated KOTS CLI. For information about retrieving GitHub IP addresses, see [About GitHub&#39;s IP addresses](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-githubs-ip-addresses) in the GitHub documentation.</td>
63+
</tr>
64+
<tr>
65+
<td><p>`k8s.kurl.sh`</p><p>`s3.kurl.sh`</p></td>
66+
<td>Not Required</td>
67+
<td>Not Required</td>
68+
<td>Not Required</td>
69+
<td>Required</td>
70+
<td><p>kURL installation scripts and artifacts are served from [kurl.sh](https://kurl.sh). An application identifier is sent in a URL path, and bash scripts and binary executables are served from kurl.sh. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `k8s.kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L34-L39) in GitHub.</p><p> The range of IP addresses for `s3.kurl.sh` are the same as IP addresses for the `kurl.sh` domain. For the range of IP address for `kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L28-L31) in GitHub.</p></td>
71+
</tr>
72+
<tr>
73+
<td>`amazonaws.com`</td>
74+
<td>Not Required</td>
75+
<td>Not Required</td>
76+
<td>Not Required</td>
77+
<td>Required</td>
78+
<td>`tar.gz` packages are downloaded from Amazon S3 during installations with kURL. For information about dynamically scraping the IP ranges to allowlist for accessing these packages, see [AWS IP address ranges](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-download) in the AWS documentation.</td>
79+
</tr>
80+
</table>
1781

18-
&#42; Required only if the application uses the Replicated proxy registry. Contact your software vendor for more information.
82+
&#42; Required only if the application uses the [Replicated proxy registry](/vendor/private-images-about).
1983

20-
&#42;&#42; Required only if the application uses the Replicated registry. Contact your software vendor for more information.
84+
&#42;&#42; Required only if the application uses the [Replicated registry](/vendor/private-images-replicated).
85+
86+
&#42;&#42;&#42; Required only if the [Replicated SDK](/vendor/replicated-sdk-overview) if included as a dependency of the application Helm chart.

0 commit comments

Comments
 (0)