Red Hat OpenShift Container Platform additional outbound URLs to allow at firewall and proxy level

Solution Verified - Updated -

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 3
    • 4

Issue

  • What URLs require access for a Red Hat OpenShift Container Platform cluster?
  • Which URLs must be permitted through the OCP HTTP proxy?
  • Are there additional domain considerations or subdomains necessary for access to Red Hat or third-party services (e.g., registries, specific pull images)?

Resolution

Red Hat OpenShift Container Platform depends on several registries, including the Red Hat registry, which provides the basic pod images, registry image and router image.

For Red Hat OpenShift Container Platform 4, refer to configuring your firewall section in addition to this article.

Refer also to public CIDR lists for Red Hat (IP Addresses for cdn.redhat.com) for additional information.

Below is a list of recommended URLs to be allowed on firewall or proxy. Refer to configuring your firewall for OpenShift Container Platform for an up-to-date list:

  • Registries:

     - registry.redhat.io 
 - access.redhat.com
 - registry.access.redhat.com (provides pod, registry, router, s2i, jboss and etc images)
 - registry.connect.redhat.com (provides third-party images)
 - quay.io
 - cdn.quay.io
 - cdn01.quay.io
 - cdn02.quay.io
 - cdn03.quay.io
 - cdn04.quay.io
 - cdn05.quay.io
 - cdn06.quay.io
 - icr.io (only required for IBM Cloud Paks)
 - cp.icr.io (only required for IBM Cloud Paks)
 - mirror.openshift.com
 - quayio-production-s3.s3.amazonaws.com
 - rhcos.mirror.openshift.com
 - storage.googleapis.com/openshift-release
 - api.openshift.com
 - console.redhat.com
 - sso.redhat.com
 - cert-api.access.redhat.com (Required for Telemetry)
 - api.access.redhat.com  (Required for Telemetry)
 - infogw.api.openshift.com (Required for Telemetry)

    Note: in some cases it is possible to use cdn.quay.io and cdn0[1-6].quay.io instead of *.quay.io. Refer also to what IPv4 addresses or DNS domains must be allowlisted in order to access quay.io?.

  • Third party registries (not required, but some times useful):

     - docker.io (images not in Red Hat's registry)
 - docker.com
 - hub.docker.com
 - index.docker.io

  • Depending on the firewall, it could be needed to add the following ones to be able to download image blobs:

     - oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com (CNAME)
 - s3-us-west-2.amazonaws.com
 - s3-us-east-1.amazonaws.com
 - *.us-east-1.amazonaws.com
 - *.akamaiedge.net
 - *.akamaitechnologies.com
 - *.cloudflare.net

The outbound depends also on the languages and frameworks used for the applications deployed in Red Hat OpenShift Container Platform:

  • Source code repositories (allow the ones that apply):

     - github.com
 - gitlab.com
 - Internal git repository hostnames

  • Language/framework related resources (allow only the ones that apply):

    *.maven.org
*.apache.org
*.npmjs.com
*.openshift.io
*.openshift.org
*.docker.io
*.docker.org
*.rubygems.org
*.cpan.org
*.githubusercontent.com
*.githubapp.com
*.cloudfront.net
*.fabric8.io
*.codehaus.org
*.sonatype.org
*.jboss.org
*.jenkins-ci.org
*.jenkins.io
*.bintray.com
*.spring.io
*.eclipse.org
*.fusesource.com
*.eclipse.org

Root Cause

Red Hat OpenShift Container Platform depends on the Red Hat registry, which provides the basic pod images, registry image and router image.

The outbound depends also on the languages and frameworks used for the applications deployed in Red Hat OpenShift Container Platform.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments