Configuring your firewall

If you use a firewall, you must configure it so that OKD can access the sites that it requires to function. You must always grant access to some sites, and you grant access to more if you use Red Hat Insights, the Telemetry service, a cloud to host your cluster, and certain build strategies.

Configuring your firewall for OKD

Before you install OKD, you must configure your firewall to grant access to the sites that OKD requires.

There are no special configuration considerations for services running on only controller nodes versus worker nodes.

Procedure

1. Allowlist the following registry URLs:

   URL	Port	Function
   registry.redhat.io	443, 80	Provides core container images
   access.redhat.com	443, 80	Provides core container images
   quay.io	443, 80	Provides core container images
   cdn.quay.io	443, 80	Provides core container images
   cdn01.quay.io	443, 80	Provides core container images
   cdn02.quay.io	443, 80	Provides core container images
   cdn03.quay.io	443, 80	Provides core container images
   sso.redhat.com	443, 80	The https://console.redhat.com/openshift site uses authentication from sso.redhat.com

   You can use the wildcards *.quay.io and *.openshiftapps.com instead of cdn0[1-3].quay.io in your allowlist. When you add a site, such as quay.io, to your allowlist, do not add a wildcard entry, such as *.quay.io, to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, image downloads are denied when the initial download request redirects to a hostname such as cdn01.quay.io.

2. Allowlist any site that provides resources for a language or framework that your builds require.

3. If you do not disable Telemetry, you must grant access to the following URLs to access Red Hat Insights:

   URL	Port	Function
   cert-api.access.redhat.com	443, 80	Required for Telemetry
   api.access.redhat.com	443, 80	Required for Telemetry
   infogw.api.openshift.com	443, 80	Required for Telemetry
   console.redhat.com/api/ingress, cloud.redhat.com/api/ingress	443, 80	Required for Telemetry and for insights-operator

4. If you use Alibaba Cloud, Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) to host your cluster, you must grant access to the URLs that provide the cloud provider API and DNS for that cloud:

   Cloud	URL	Port	Function
   Alibaba	.aliyuncs.com	443, 80	Required to access Alibaba Cloud services and resources. Review the Alibaba endpoints_config.go file to determine the exact endpoints to allow for the regions that you use.
   AWS	.amazonaws.com	443, 80	Required to access AWS services and resources. Review the AWS Service Endpoints in the AWS documentation to determine the exact endpoints to allow for the regions that you use.
   GCP	.googleapis.com	443, 80	Required to access GCP services and resources. Review Cloud Endpoints in the GCP documentation to determine the endpoints to allow for your APIs.
   	accounts.google.com	443, 80	Required to access your GCP account.
   Azure	management.azure.com	443, 80	Required to access Azure services and resources. Review the Azure REST API reference in the Azure documentation to determine the endpoints to allow for your APIs.
   	.blob.core.windows.net	443, 80	Required to download Ignition files.
   	login.microsoftonline.com	443, 80	Required to access Azure services and resources. Review the Azure REST API reference in the Azure documentation to determine the endpoints to allow for your APIs.

5. Allowlist the following URLs:

   URL	Port	Function
   mirror.openshift.com	443, 80	Required to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
   storage.googleapis.com/openshift-release	443, 80	A source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
   *.apps.<cluster_name>.<base_domain>	443, 80	Required to access the default cluster routes unless you set an ingress wildcard during installation.
   quayio-production-s3.s3.amazonaws.com	443, 80	Required to access Quay image content in AWS.
   api.openshift.com	443, 80	Required both for your cluster token and to check if updates are available for the cluster.
   rhcos.mirror.openshift.com	443, 80	Required to download Fedora CoreOS (FCOS) images.
   console.redhat.com/openshift	443, 80	Required for your cluster token.
   registry.access.redhat.com	443, 80	Required for odo CLI.
   sso.redhat.com	443, 80	The https://console.redhat.com/openshift site uses authentication from sso.redhat.com

   Operators require route access to perform health checks. Specifically, the authentication and web console Operators connect to two routes to verify that the routes work. If you are the cluster administrator and do not want to allow *.apps.<cluster_name>.<base_domain>, then allow these routes:

   • oauth-openshift.apps.<cluster_name>.<base_domain>

   • console-openshift-console.apps.<cluster_name>.<base_domain>, or the hostname that is specified in the spec.route.hostname field of the consoles.operator/cluster object if the field is not empty.

6. Allowlist the following URLs for optional third-party content:

   URL	Port	Function
   registry.connect.redhat.com	443, 80	Required for all third-party images and certified operators.
   rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com	443, 80	Provides access to container images hosted on registry.connect.redhat.com
   oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com	443, 80	Required for Sonatype Nexus, F5 Big IP operators.

7. If you use a default Red Hat Network Time Protocol (NTP) server allow the following URLs:

   • 1.rhel.pool.ntp.org

   • 2.rhel.pool.ntp.org

   • 3.rhel.pool.ntp.org