This is a cache of https://docs.openshift.com/container-platform/4.2/installing/install_config/configuring-firewall.html. It is a snapshot of the page at 2024-11-28T02:27:06.068+0000.
Configuring your firewall - Installation configuration | Installing | OpenShift Container Platform 4.2
    OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Configuring your firewall

If you use a firewall, you must configure it so that OpenShift Container Platform can access the sites that it requires to function. You must always grant access to some sites, and you grant access to more if you use Red Hat Insights, the Telemetry service, a cloud to host your cluster, and certain build strategies.

Configuring your firewall for OpenShift Container Platform

Before you install OpenShift Container Platform, you must configure your firewall to grant access to the sites that OpenShift Container Platform requires.

Procedure

  1. Whitelist the following registry URLs:

    URL Function

    registry.redhat.io

    Provides core container images

    quay.io

    Provides core container images

    sso.redhat.com

    The https://cloud.redhat.com/openshift site uses authentication from sso.redhat.com

  2. Whitelist any site that provides resources for a language or framework that your builds require.

  3. If you do not disable Telemetry, you must grant access to the following URLs to access Red Hat Insights:

    URL Function

    cert-api.access.redhat.com

    Required for Telemetry

    api.access.redhat.com

    Required for Telemetry

    infogw.api.openshift.com

    Required for Telemetry

    https://cloud.redhat.com/api/ingress

    Required for Telemetry and for insights-operator

  4. If you use Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) to host your cluster, you must grant access to the URLs that provide the cloud provider API and DNS for that cloud:

    Cloud URL Function

    AWS

    *.amazonaws.com

    Required to access AWS services and resources. Review the AWS Service Endpoints in the AWS documentation to determine the exact endpoints to allow for the regions that you use.

    GCP

    *.googleapis.com

    Required to access GCP services and resources. Review Cloud Endpoints in the GCP documentation to determine the endpoints to allow for your APIs.

    accounts.google.com

    Required to access your GCP account.

    Azure

    management.azure.com

    Required to access Azure services and resources. Review the Azure REST API Reference in the Azure documentation to determine the endpoints to allow for your APIs.

  5. Whitelist the following URLs:

    URL Function

    mirror.openshift.com

    Required to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator needs only a single functioning source.

    storage.googleapis.com/openshift-release

    A source of release image signatures, although the Cluster Version Operator needs only a single functioning source.

    *.apps.<cluster_name>.<base_domain>

    Required to access the default cluster routes unless you set an ingress wildcard during installation.

    quay-registry.s3.amazonaws.com

    Required to access Quay image content in AWS.

    api.openshift.com

    Required to check if updates are available for the cluster.

    art-rhcos-ci.s3.amazonaws.com

    Required to download Red Hat Enterprise Linux CoreOS (RHCOS) images.

    api.openshift.com

    Required for your cluster token.

    cloud.redhat.com/openshift

    Required for your cluster token.