Detailed requirements for deploying ROSA using STS | Prepare your environment | Red Hat OpenShift <strong>service</strong> on AWS

edit

Red Hat OpenShift service on AWS (ROSA) provides a model that allows Red Hat to deploy clusters into a customer’s existing Amazon Web service (AWS) account.

AWS Security Token service (STS) is the recommended credential mode for installing and interacting with clusters on Red Hat OpenShift service on AWS (ROSA) because it provides enhanced security.

Ensure that the following AWS prerequisites are met before installing ROSA with STS.

When you create a ROSA cluster using AWS STS, an associated AWS OpenID Connect (OIDC) identity provider is created as well. This OIDC provider configuration relies on a public key that is located in the us-east-1 AWS region. Customers with AWS SCPs must allow the use of the us-east-1 AWS region, even if these clusters are deployed in a different region.

edit

Customer requirements when using STS for deployment

The following prerequisites must be complete before you deploy a Red Hat OpenShift service on AWS (ROSA) cluster that uses the AWS Security Token service (STS).

edit

Account

You must ensure that the AWS limits are sufficient to support Red Hat OpenShift service on AWS provisioned within your AWS account. Running the rosa verify quota command in the CLI validates that you have the required quota to run a cluster.

Quota verification checks your AWS quota, but it does not compare your consumption to your AWS quota. See the "Limits and scalability" link in Additional resources for more information.
If SCP policies are applied and enforced, these policies must not be more restrictive than the roles and policies required by the cluster.
Your AWS account should not be transferable to Red Hat.
You should not impose additional AWS usage restrictions beyond the defined roles and policies on Red Hat activities. Imposing restrictions will severely hinder Red Hat’s ability to respond to incidents.
You may deploy native AWS services within the same AWS account.

Your account must have a service-linked role set up as it is required for Elastic Load Balancing (ELB) to be configured. See the "Creating the Elastic Load Balancing (ELB) service-linked role" link in the Additional resources for information about creating a service-linked role for your ELB if you have not created a load balancer in your AWS account previously.

You are encouraged, but not required, to deploy resources in a Virtual Private Cloud (VPC) separate from the VPC hosting Red Hat OpenShift service on AWS and other Red Hat supported services.

Additional resources

edit

Access requirements

Red Hat must have AWS console access to the customer-provided AWS account. Red Hat protects and manages this access.
You must not use the AWS account to elevate your permissions within the Red Hat OpenShift service on AWS (ROSA) cluster.
Actions available in the ROSA CLI (rosa) or OpenShift Cluster Manager console must not be directly performed in your AWS account.
You do not need to have a preconfigured domain to deploy ROSA clusters. If you wish to use a custom domain, see the Additional resources for information.

Additional resources

See Configuring custom domains for applications

edit

Support requirements

Red Hat recommends that the customer have at least Business Support from AWS.
Red Hat may have permission from the customer to request AWS support on their behalf.
Red Hat may have permission from the customer to request AWS resource limit increases on the customer’s account.
Red Hat manages the restrictions, limitations, expectations, and defaults for all Red Hat OpenShift service on AWS clusters in the same manner, unless otherwise specified in this requirements section.

edit

Security requirements

Red Hat must have ingress access to EC2 hosts and the API server from allow-listed IP addresses.
Red Hat must have egress allowed to the documented domains. See the "AWS firewall prerequisites" section for the designated domains.

Additional resources

AWS firewall prerequisites

edit

Requirements for using OpenShift Cluster Manager

The following sections describe requirements for OpenShift Cluster Manager. If you use the CLI tools exclusively, then you can disregard the requirements.

To use OpenShift Cluster Manager, you must link your AWS accounts. This linking concept is also known as account association.

edit

AWS account association

Red Hat OpenShift service on AWS (ROSA) cluster-provisioning tasks require linking ocm-role and user-role IAM roles to your AWS account using your Amazon Resource Name (ARN).

The ocm-role ARN is stored as a label in your Red Hat organization while the user-role ARN is stored as a label inside your Red Hat user account. Red Hat uses these ARN labels to confirm that the user is a valid account holder and that the correct permissions are available to perform the necessary tasks in the AWS account.

edit

Linking your AWS account

You can link your AWS account to existing IAM roles by using the Red Hat OpenShift service on AWS (ROSA) CLI, rosa.

Prerequisites

You have an AWS account.
You are using OpenShift Cluster Manager to create clusters.
You have the permissions required to install AWS account-wide roles. See the "Additional resources" of this section for more information.
You have installed and configured the latest AWS (aws) and ROSA (rosa) CLIs on your installation host.
You have created your ocm-role and user-role IAM roles, but have not yet linked them to your AWS account. You can check whether your IAM roles are already linked by running the following commands:
```
$ rosa list ocm-role
```
```
$ rosa list user-role
```
If Yes is displayed in the Linked column for both roles, you have already linked the roles to an AWS account.

Procedure

From the CLI, link your ocm-role resource to your Red Hat organization by using your Amazon Resource Name (ARN):

You must have Red Hat Organization Administrator privileges to run the rosa link command. After you link the ocm-role resource with your AWS account, it is visible for all users in the organization.

$ rosa link ocm-role --role-arn <arn>

Example output

I: Linking OCM role
? Link the '<AWS ACCOUNT ID>` role with organization '<ORG ID>'? Yes
I: Successfully linked role-arn '<AWS ACCOUNT ID>' with organization account '<ORG ID>'

From the CLI, link your user-role resource to your Red Hat user account by using your Amazon Resource Name (ARN):

$ rosa link user-role --role-arn <arn>

Example output

I: Linking User role
? Link the 'arn:aws:iam::<ARN>:role/ManagedOpenShift-User-Role-125' role with organization '<AWS ID>'? Yes
I: Successfully linked role-arn 'arn:aws:iam::<ARN>:role/ManagedOpenShift-User-Role-125' with organization account '<AWS ID>'

Additional resources

See Account-wide IAM role and policy reference for a list of IAM roles needed for cluster creation.

edit

Associating multiple AWS accounts with your Red Hat organization

You can associate multiple AWS accounts with your Red Hat organization. Associating multiple accounts lets you create Red Hat OpenShift service on AWS (ROSA) clusters on any of the associated AWS accounts from your Red Hat organization.

With this feature, you can create clusters in different AWS regions by using multiple AWS profiles as region-bound environments.

Prerequisites

You have an AWS account.
You are using OpenShift Cluster Manager to create clusters.
You have the permissions required to install AWS account-wide roles.
You have installed and configured the latest AWS (aws) and ROSA (rosa) CLIs on your installation host.
You have created your ocm-role and user-role IAM roles.

Procedure

To associate an additional AWS account, first create a profile in your local AWS configuration. Then, associate the account with your Red Hat organization by creating the ocm-role, user, and account roles in the additional AWS account.

To create the roles in an additional region, specify the --profile <aws-profile> parameter when running the rosa create commands and replace <aws_profile> with the additional account profile name:

To specify an AWS account profile when creating an OpenShift Cluster Manager role:
```
$ rosa create --profile <aws_profile> ocm-role
```
To specify an AWS account profile when creating a user role:
```
$ rosa create --profile <aws_profile> user-role
```
To specify an AWS account profile when creating the account roles:
```
$ rosa create --profile <aws_profile> account-roles
```

If you do not specify a profile, the default AWS profile is used.

edit

Requirements for deploying a cluster in an opt-in region

An AWS opt-in region is a region that is not enabled by default. If you want to deploy a Red Hat OpenShift service on AWS (ROSA) cluster that uses the AWS Security Token service (STS) in an opt-in region, you must meet the following requirements:

The region must be enabled in your AWS account. For more information about enabling opt-in regions, see Managing AWS Regions in the AWS documentation.

The security token version in your AWS account must be set to version 2. You cannot use version 1 security tokens for opt-in regions.

Updating to security token version 2 can impact the systems that store the tokens, due to the increased token length. For more information, see the AWS documentation on setting STS preferences.

edit

Setting the AWS security token version

If you want to create a Red Hat OpenShift service on AWS (ROSA) cluster with the AWS Security Token service (STS) in an AWS opt-in region, you must set the security token version to version 2 in your AWS account.

Prerequisites

You have installed and configured the latest AWS CLI on your installation host.

Procedure

List the ID of the AWS account that is defined in your AWS CLI configuration:
```
$ aws sts get-caller-identity --query Account --output json
```
Ensure that the output matches the ID of the relevant AWS account.

List the security token version that is set in your AWS account:

$ aws iam get-account-summary --query SummaryMap.GlobalEndpointTokenVersion --output json

Example output

To update the security token version to version 2 for all regions in your AWS account, run the following command:

$ aws iam set-security-token-service-preferences --global-endpoint-token-version v2Token

Updating to security token version 2 can impact the systems that store the tokens, due to the increased token length. For more information, see the AWS documentation on setting STS preferences.

Red Hat managed IAM references for AWS

With the STS deployment model, Red Hat is no longer responsible for creating and managing Amazon Web services (AWS) IAM policies, IAM users, or IAM roles. For information on creating these roles and policies, see the following sections on IAM roles.

To use the ocm CLI, you must have an ocm-role and user-role resource. See OpenShift Cluster Manager IAM role resources.
If you have a single cluster, see Account-wide IAM role and policy reference.
For every cluster, you must have the necessary operator roles. See Cluster-specific Operator IAM role reference.

Provisioned AWS Infrastructure

This is an overview of the provisioned Amazon Web services (AWS) components on a deployed Red Hat OpenShift service on AWS (ROSA) cluster. For a more detailed listing of all provisioned AWS components, see the OpenShift Container Platform documentation.

edit

EC2 instances

AWS EC2 instances are required for deploying the control plane and data plane functions of ROSA in the AWS public cloud.

Instance types can vary for control plane and infrastructure nodes, depending on the worker node count. At a minimum, the following EC2 instances will be deployed:

Three m5.2xlarge control plane nodes
Two r5.xlarge infrastructure nodes
Two m5.xlarge customizable worker nodes

For further guidance on worker node counts, see the information about initial planning considerations in the "Limits and scalability" topic listed in the "Additional resources" section of this page.

Amazon Elastic Block Store storage

Amazon Elastic Block Store (Amazon EBS) block storage is used for both local node storage and persistent volume storage.

Volume requirements for each EC2 instance:

Control Plane Volume
- Size: 350GB
- Type: gp3
- Input/Output Operations Per Second: 1000
Infrastructure Volume
- Size: 300GB
- Type: gp3
- Input/Output Operations Per Second: 900
Worker Volume
- Size: 300GB
- Type: gp3
- Input/Output Operations Per Second: 900

Clusters deployed before the release of OpenShift Container Platform 4.11 use gp2 type storage by default.

Elastic Load Balancing

Up to two Network Load Balancers for API and up to two Classic Load Balancers for application router. For more information, see the ELB documentation for AWS.

S3 storage

The image registry is backed by AWS S3 storage. Pruning of resources is performed regularly to optimize S3 usage and cluster performance.

Two buckets are required with a typical size of 2TB each.

VPC

Customers should expect to see one VPC per cluster. Additionally, the VPC will need the following configurations:

Subnets: Two subnets for a cluster with a single availability zone, or six subnets for a cluster with multiple availability zones.

A public subnet connects directly to the internet through an internet gateway. A private subnet connects to the internet through a network address translation (NAT) gateway.
Route tables: One route table per private subnet, and one additional table per cluster.
Internet gateways: One Internet Gateway per cluster.
NAT gateways: One NAT Gateway per public subnet.

Figure 1. Sample VPC Architecture

Security groups

AWS security groups provide security at the protocol and port access level; they are associated with EC2 instances and Elastic Load Balancing (ELB) load balancers. Each security group contains a set of rules that filter traffic coming in and out of one or more EC2 instances. You must ensure the ports required for the OpenShift installation are open on your network and configured to allow access between hosts.

Table 1. Required ports for default security groups
Group	Type	IP Protocol	Port range
MasterSecurityGroup	`AWS::EC2::SecurityGroup`	`icmp`	`0`
		`tcp`	`22`
		`tcp`	`6443`
		`tcp`	`22623`
WorkerSecurityGroup	`AWS::EC2::SecurityGroup`	`icmp`	`0`
WorkerSecurityGroup	`AWS::EC2::SecurityGroup`	`tcp`	`22`
BootstrapSecurityGroup	`AWS::EC2::SecurityGroup`	`tcp`	`22`
BootstrapSecurityGroup	`AWS::EC2::SecurityGroup`	`tcp`	`19531`

Additional custom security groups

When you create a cluster using an existing non-managed VPC, you can add additional custom security groups during cluster creation. Custom security groups are subject to the following limitations:

You must create the custom security groups in AWS before you create the cluster. For more information, see Amazon EC2 security groups for Linux instances.
You must associate the custom security groups with the VPC that the cluster will be installed into. Your custom security groups cannot be associated with another VPC.
You might need to request additional quota for your VPC if you are adding additional custom security groups. For information on AWS quota requirements for ROSA, see Required AWS service quotas in Prepare your environment. For information on requesting an AWS quota increase, see Requesting a quota increase.

Networking prerequisites

edit

Minimum bandwidth

During cluster deployment, Red Hat OpenShift service on AWS requires a minimum bandwidth of 120 Mbps between cluster resources and public internet resources. When network connectivity is slower than 120 Mbps (for example, when connecting through a proxy) the cluster installation process times out and deployment fails.

After deployment, network requirements are determined by your workload. However, a minimum bandwidth of 120 Mbps helps to ensure timely cluster and operator upgrades.

AWS firewall prerequisites

If you are using a firewall to control egress traffic from your Red Hat OpenShift service on AWS, you must configure your firewall to grant access to the certain domain and port combinations below. Red Hat OpenShift service on AWS requires this access to provide a fully managed OpenShift service.

edit

ROSA Classic

Only ROSA clusters deployed with PrivateLink can use a firewall to control egress traffic.

Prerequisites

You have configured an Amazon S3 gateway endpoint in your AWS Virtual Private Cloud (VPC). This endpoint is required to complete requests from the cluster to the Amazon S3 service.

Procedure

Allowlist the following URLs that are used to install and download packages and tools:

Domain Port Function

Domain	Port	Function
`registry.redhat.io`	443	Provides core container images.
`quay.io`	443	Provides core container images.
`cdn01.quay.io`	443	Provides core container images.
`cdn02.quay.io`	443	Provides core container images.
`cdn03.quay.io`	443	Provides core container images.
`sso.redhat.com`	443	Required. The `https://console.redhat.com/openshift` site uses authentication from `sso.redhat.com` to download the pull secret and use Red Hat SaaS solutions to facilitate monitoring of your subscriptions, cluster inventory, chargeback reporting, and so on.
`quay-registry.s3.amazonaws.com`	443	Provides core container images.
`quayio-production-s3.s3.amazonaws.com`	443	Provides core container images.
`openshift.org`	443	Provides Red Hat Enterprise Linux CoreOS (RHCOS) images.
`registry.access.redhat.com`	443	Hosts all the container images that are stored on the Red Hat Ecosytem Catalog. Additionally, the registry provides access to the `odo` CLI tool that helps developers build on OpenShift and Kubernetes.
`access.redhat.com`	443	Required. Hosts a signature store that a container client requires for verifying images when pulling them from `registry.access.redhat.com`.
`registry.connect.redhat.com`	443	Required for all third-party images and certified Operators.
`console.redhat.com`	443	Required. Allows interactions between the cluster and OpenShift Console Manager to enable functionality, such as scheduling upgrades.
`sso.redhat.com`	443	The `https://console.redhat.com/openshift` site uses authentication from `sso.redhat.com`.
`pull.q1w2.quay.rhcloud.com`	443	Provides core container images as a fallback when quay.io is not available.
`.q1w2.quay.rhcloud.com`	443	Provides core container images as a fallback when quay.io is not available.
`www.okd.io`	443	The `openshift.org` site redirects through `www.okd.io`.
`www.redhat.com`	443	The `sso.redhat.com` site redirects through `www.redhat.com`.
`aws.amazon.com`	443	The `iam.amazonaws.com` and `sts.amazonaws.com` sites redirect through `aws.amazon.com`.
`catalog.redhat.com`	443	The `registry.access.redhat.com` and `https://registry.redhat.io` sites redirect through `catalog.redhat.com`.
`dvbwgdztaeq9o.cloudfront.net` ^[1]	443	Used by ROSA for STS implementation with managed OIDC configuration.
`time-a-g.nist.gov`	123 ^[2]	Allows NTP traffic for FedRAMP.
`time-a-wwv.nist.gov`	123 ^[2]	Allows NTP traffic for FedRAMP.
`time-a-b.nist.gov`	123 ^[2]	Allows NTP traffic for FedRAMP.

registry.redhat.io

443

Provides core container images.

quay.io

443

Provides core container images.

cdn01.quay.io

443

Provides core container images.

cdn02.quay.io

443

Provides core container images.

cdn03.quay.io

443

Provides core container images.

sso.redhat.com

443

Required. The https://console.redhat.com/openshift site uses authentication from sso.redhat.com to download the pull secret and use Red Hat SaaS solutions to facilitate monitoring of your subscriptions, cluster inventory, chargeback reporting, and so on.

quay-registry.s3.amazonaws.com

443

Provides core container images.

quayio-production-s3.s3.amazonaws.com

443

Provides core container images.

openshift.org

443

Provides Red Hat Enterprise Linux CoreOS (RHCOS) images.

registry.access.redhat.com

443

Hosts all the container images that are stored on the Red Hat Ecosytem Catalog. Additionally, the registry provides access to the odo CLI tool that helps developers build on OpenShift and Kubernetes.

access.redhat.com

443

Required. Hosts a signature store that a container client requires for verifying images when pulling them from registry.access.redhat.com.

registry.connect.redhat.com

443

Required for all third-party images and certified Operators.

console.redhat.com

443

Required. Allows interactions between the cluster and OpenShift Console Manager to enable functionality, such as scheduling upgrades.

sso.redhat.com

443

The https://console.redhat.com/openshift site uses authentication from sso.redhat.com.

pull.q1w2.quay.rhcloud.com

443

Provides core container images as a fallback when quay.io is not available.

.q1w2.quay.rhcloud.com

443

Provides core container images as a fallback when quay.io is not available.

www.okd.io

443

The openshift.org site redirects through www.okd.io.

www.redhat.com

443

The sso.redhat.com site redirects through www.redhat.com.

aws.amazon.com

443

The iam.amazonaws.com and sts.amazonaws.com sites redirect through aws.amazon.com.

catalog.redhat.com

443

The registry.access.redhat.com and https://registry.redhat.io sites redirect through catalog.redhat.com.

dvbwgdztaeq9o.cloudfront.net ^[1]

443

Used by ROSA for STS implementation with managed OIDC configuration.

time-a-g.nist.gov

123 ^[2]

Allows NTP traffic for FedRAMP.

time-a-wwv.nist.gov

123 ^[2]

Allows NTP traffic for FedRAMP.

time-a-b.nist.gov

123 ^[2]

Allows NTP traffic for FedRAMP.

The string of alphanumeric characters before cloudfront.net could change if there is a major cloudfront outage that requires redirecting the resource.
Both TCP and UDP ports.

Allowlist the following telemetry URLs:

Domain Port Function

Domain	Port	Function
`cert-api.access.redhat.com`	443	Required for telemetry.
`api.access.redhat.com`	443	Required for telemetry.
`infogw.api.openshift.com`	443	Required for telemetry.
`console.redhat.com`	443	Required for telemetry and Red Hat Insights.
`cloud.redhat.com/api/ingress`	443	Required for telemetry and Red Hat Insights.
`observatorium-mst.api.openshift.com`	443	Required for managed OpenShift-specific telemetry.
`observatorium.api.openshift.com`	443	Required for managed OpenShift-specific telemetry.

cert-api.access.redhat.com

443

Required for telemetry.

api.access.redhat.com

443

Required for telemetry.

infogw.api.openshift.com

443

Required for telemetry.

console.redhat.com

443

Required for telemetry and Red Hat Insights.

cloud.redhat.com/api/ingress

443

Required for telemetry and Red Hat Insights.

observatorium-mst.api.openshift.com

443

Required for managed OpenShift-specific telemetry.

observatorium.api.openshift.com

443

Required for managed OpenShift-specific telemetry.

Managed clusters require enabling telemetry to allow Red Hat to react more quickly to problems, better support the customers, and better understand how product upgrades impact clusters. For more information about how remote health monitoring data is used by Red Hat, see About remote health monitoring in the Additional resources section.

Allowlist the following Amazon Web services (AWS) API URls:

Domain Port Function

Domain	Port	Function
`.amazonaws.com`	443	Required to access AWS services and resources.

.amazonaws.com

443

Required to access AWS services and resources.

Alternatively, if you choose to not use a wildcard for Amazon Web services (AWS) APIs, you must allowlist the following URLs:

Domain Port Function

Domain	Port	Function
`ec2.amazonaws.com`	443	Used to install and manage clusters in an AWS environment.
`events.<aws_region>.amazonaws.com`	443	Used to install and manage clusters in an AWS environment.
`iam.amazonaws.com`	443	Used to install and manage clusters in an AWS environment.
`route53.amazonaws.com`	443	Used to install and manage clusters in an AWS environment.
`sts.amazonaws.com`	443	Used to install and manage clusters in an AWS environment, for clusters configured to use the global endpoint for AWS STS.
`sts.<aws_region>.amazonaws.com`	443	Used to install and manage clusters in an AWS environment, for clusters configured to use regionalized endpoints for AWS STS. See AWS STS regionalized endpoints for more information.
`tagging.us-east-1.amazonaws.com`	443	Used to install and manage clusters in an AWS environment. This endpoint is always us-east-1, regardless of the region the cluster is deployed in.
`ec2.<aws_region>.amazonaws.com`	443	Used to install and manage clusters in an AWS environment.
`elasticloadbalancing.<aws_region>.amazonaws.com`	443	Used to install and manage clusters in an AWS environment.
`tagging.<aws_region>.amazonaws.com`	443	Allows the assignment of metadata about AWS resources in the form of tags.

ec2.amazonaws.com

443

Used to install and manage clusters in an AWS environment.

events.<aws_region>.amazonaws.com

443

Used to install and manage clusters in an AWS environment.

iam.amazonaws.com

443

Used to install and manage clusters in an AWS environment.

route53.amazonaws.com

443

Used to install and manage clusters in an AWS environment.

sts.amazonaws.com

443

Used to install and manage clusters in an AWS environment, for clusters configured to use the global endpoint for AWS STS.

sts.<aws_region>.amazonaws.com

443

Used to install and manage clusters in an AWS environment, for clusters configured to use regionalized endpoints for AWS STS. See AWS STS regionalized endpoints for more information.

tagging.us-east-1.amazonaws.com

443

Used to install and manage clusters in an AWS environment. This endpoint is always us-east-1, regardless of the region the cluster is deployed in.

ec2.<aws_region>.amazonaws.com

443

Used to install and manage clusters in an AWS environment.

elasticloadbalancing.<aws_region>.amazonaws.com

443

Used to install and manage clusters in an AWS environment.

tagging.<aws_region>.amazonaws.com

443

Allows the assignment of metadata about AWS resources in the form of tags.

Allowlist the following OpenShift URLs:

Domain Port Function

Domain	Port	Function
`mirror.openshift.com`	443	Used to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator (CVO) needs only a single functioning source.
`storage.googleapis.com/openshift-release` (Recommended)	443	Alternative site to mirror.openshift.com/. Used to download platform release signatures that are used by the cluster to know what images to pull from quay.io.
`api.openshift.com`	443	Used to check if updates are available for the cluster.

mirror.openshift.com

443

Used to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator (CVO) needs only a single functioning source.

storage.googleapis.com/openshift-release (Recommended)

443

Alternative site to mirror.openshift.com/. Used to download platform release signatures that are used by the cluster to know what images to pull from quay.io.

api.openshift.com

443

Used to check if updates are available for the cluster.

Allowlist the following site reliability engineering (SRE) and management URLs:

Domain Port Function

Domain	Port	Function
`api.pagerduty.com`	443	This alerting service is used by the in-cluster alertmanager to send alerts notifying Red Hat SRE of an event to take action on.
`events.pagerduty.com`	443	This alerting service is used by the in-cluster alertmanager to send alerts notifying Red Hat SRE of an event to take action on.
`api.deadmanssnitch.com`	443	Alerting service used by Red Hat OpenShift service on AWS to send periodic pings that indicate whether the cluster is available and running.
`nosnch.in`	443	Alerting service used by Red Hat OpenShift service on AWS to send periodic pings that indicate whether the cluster is available and running.
`.osdsecuritylogs.splunkcloud.com` OR `inputs1.osdsecuritylogs.splunkcloud.com` `inputs2.osdsecuritylogs.splunkcloud.com` `inputs4.osdsecuritylogs.splunkcloud.com` `inputs5.osdsecuritylogs.splunkcloud.com` `inputs6.osdsecuritylogs.splunkcloud.com` `inputs7.osdsecuritylogs.splunkcloud.com` `inputs8.osdsecuritylogs.splunkcloud.com` `inputs9.osdsecuritylogs.splunkcloud.com` `inputs10.osdsecuritylogs.splunkcloud.com` `inputs11.osdsecuritylogs.splunkcloud.com` `inputs12.osdsecuritylogs.splunkcloud.com` `inputs13.osdsecuritylogs.splunkcloud.com` `inputs14.osdsecuritylogs.splunkcloud.com` `inputs15.osdsecuritylogs.splunkcloud.com`	9997	Used by the `splunk-forwarder-operator` as a logging forwarding endpoint to be used by Red Hat SRE for log-based alerting.
`http-inputs-osdsecuritylogs.splunkcloud.com`	443	Required. Used by the `splunk-forwarder-operator` as a logging forwarding endpoint to be used by Red Hat SRE for log-based alerting.
`sftp.access.redhat.com` (Recommended)	22	The SFTP server used by `must-gather-operator` to upload diagnostic logs to help troubleshoot issues with the cluster.

api.pagerduty.com

443

This alerting service is used by the in-cluster alertmanager to send alerts notifying Red Hat SRE of an event to take action on.

events.pagerduty.com

443

This alerting service is used by the in-cluster alertmanager to send alerts notifying Red Hat SRE of an event to take action on.

api.deadmanssnitch.com

443

Alerting service used by Red Hat OpenShift service on AWS to send periodic pings that indicate whether the cluster is available and running.

nosnch.in

443

Alerting service used by Red Hat OpenShift service on AWS to send periodic pings that indicate whether the cluster is available and running.

.osdsecuritylogs.splunkcloud.com OR inputs1.osdsecuritylogs.splunkcloud.com inputs2.osdsecuritylogs.splunkcloud.com inputs4.osdsecuritylogs.splunkcloud.com inputs5.osdsecuritylogs.splunkcloud.com inputs6.osdsecuritylogs.splunkcloud.com inputs7.osdsecuritylogs.splunkcloud.com inputs8.osdsecuritylogs.splunkcloud.com inputs9.osdsecuritylogs.splunkcloud.com inputs10.osdsecuritylogs.splunkcloud.com inputs11.osdsecuritylogs.splunkcloud.com inputs12.osdsecuritylogs.splunkcloud.com inputs13.osdsecuritylogs.splunkcloud.com inputs14.osdsecuritylogs.splunkcloud.com inputs15.osdsecuritylogs.splunkcloud.com

9997

Used by the splunk-forwarder-operator as a logging forwarding endpoint to be used by Red Hat SRE for log-based alerting.

http-inputs-osdsecuritylogs.splunkcloud.com

443

Required. Used by the splunk-forwarder-operator as a logging forwarding endpoint to be used by Red Hat SRE for log-based alerting.

sftp.access.redhat.com (Recommended)

The SFTP server used by must-gather-operator to upload diagnostic logs to help troubleshoot issues with the cluster.

Allowlist the following URLs for optional third-party content:

Domain Port Function

Domain	Port	Function
`registry.connect.redhat.com`	443	Required for all third-party-images and certified operators.
`rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com`	443	Provides access to container images hosted on `registry.connect.redhat.com`
`oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com`	443	Required for Sonatype Nexus, F5 Big IP operators.

registry.connect.redhat.com

443

Required for all third-party-images and certified operators.

rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com

443

Provides access to container images hosted on registry.connect.redhat.com

oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com

443

Required for Sonatype Nexus, F5 Big IP operators.

Allowlist any site that provides resources for a language or framework that your builds require.
Allowlist any outbound URLs that depend on the languages and frameworks used in OpenShift. See OpenShift Outbound URLs to Allow for a list of recommended URLs to be allowed on the firewall or proxy.

edit

ROSA with HCP

Prerequisites

You have configured an Amazon S3 gateway endpoint in your AWS Virtual Private Cloud (VPC). This endpoint is required to complete requests from the cluster to the Amazon S3 service.

Procedure

Allowlist the following URLs that are used to download and install packages and tools:

Domain Port Function

Domain	Port	Function
`quay.io`	443	Provides core container images.
`cdn01.quay.io`	443	Provides core container images.
`cdn02.quay.io`	443	Provides core container images.
`cdn03.quay.io`	443	Provides core container images.
`quayio-production-s3.s3.amazonaws.com`	443	Provides core container images.
`registry.redhat.io`	443	Provides core container images.
`registry.access.redhat.com`	443	Required. Hosts all the container images that are stored on the Red Hat Ecosytem Catalog. Additionally, the registry provides access to the `odo` CLI tool that helps developers build on OpenShift and Kubernetes.
`access.redhat.com`	443	Required. Hosts a signature store that a container client requires for verifying images when pulling them from `registry.access.redhat.com`.
`api.openshift.com`	443	Required. Used to check for available updates to the cluster.
`mirror.openshift.com`	443	Required. Used to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator (CVO) needs only a single functioning source.

quay.io

443

Provides core container images.

cdn01.quay.io

443

Provides core container images.

cdn02.quay.io

443

Provides core container images.

cdn03.quay.io

443

Provides core container images.

quayio-production-s3.s3.amazonaws.com

443

Provides core container images.

registry.redhat.io

443

Provides core container images.

registry.access.redhat.com

443

Required. Hosts all the container images that are stored on the Red Hat Ecosytem Catalog. Additionally, the registry provides access to the odo CLI tool that helps developers build on OpenShift and Kubernetes.

access.redhat.com

443

Required. Hosts a signature store that a container client requires for verifying images when pulling them from registry.access.redhat.com.

api.openshift.com

443

Required. Used to check for available updates to the cluster.

mirror.openshift.com

443

Required. Used to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator (CVO) needs only a single functioning source.

Allowlist the following telemetry URLs:

Domain Port Function

Domain	Port	Function
`infogw.api.openshift.com`	443	Required for telemetry.
`console.redhat.com`	443	Required. Allows interactions between the cluster and OpenShift Console Manager to enable functionality, such as scheduling upgrades.
`sso.redhat.com`	443	Required. The `https://console.redhat.com/openshift` site uses authentication from `sso.redhat.com` to download the pull secret and use Red Hat SaaS solutions to facilitate monitoring of your subscriptions, cluster inventory, chargeback reporting, etc.

infogw.api.openshift.com

443

Required for telemetry.

console.redhat.com

443

Required. Allows interactions between the cluster and OpenShift Console Manager to enable functionality, such as scheduling upgrades.

sso.redhat.com

443

Allowlist the following Amazon Web services (AWS) API URls:

Domain Port Function

Domain	Port	Function
`sts.<aws_region>.amazonaws.com` ^[1]	443	Required. Used to access the AWS Secure Token service (STS) regional endpoint. Ensure that you replace `<aws-region>` with the region that your cluster is deployed in.
`sts.amazonaws.com` ^[2]	443	See footnote. Used to access the AWS Secure Token service (STS) global endpoint.

sts.<aws_region>.amazonaws.com ^[1]

443

Required. Used to access the AWS Secure Token service (STS) regional endpoint. Ensure that you replace <aws-region> with the region that your cluster is deployed in.

sts.amazonaws.com ^[2]

443

See footnote. Used to access the AWS Secure Token service (STS) global endpoint.

This can also be accomplished by configuring a private interface endpoint in your AWS Virtual Private Cloud (VPC) to the regional AWS STS endpoint.
The AWS STS global endpoint is only required to be allowed if you are running a version of OpenShift before 4.14.18 or 4.15.4. ROSA HCP version 4.14.18+, 4.15.4+, and 4.16.0+ use the AWS STS regional endpoint.

Allowlist the following URLs for optional third-party content:

Domain Port Function

Domain	Port	Function
`registry.connect.redhat.com`	443	Optional. Required for all third-party-images and certified operators.
`rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com`	443	Optional. Provides access to container images hosted on `registry.connect.redhat.com`.
`oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com`	443	Optional. Required for Sonatype Nexus, F5 Big IP operators.

registry.connect.redhat.com

443

Optional. Required for all third-party-images and certified operators.

rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com

443

Optional. Provides access to container images hosted on registry.connect.redhat.com.

oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com

443

Optional. Required for Sonatype Nexus, F5 Big IP operators.

Allowlist any site that provides resources for a language or framework that your builds require.
Allowlist any outbound URLs that depend on the languages and frameworks used in OpenShift. See OpenShift Outbound URLs to Allow for a list of recommended URLs to be allowed on the firewall or proxy.

Additional resources

About remote health monitoring

Next steps

Review the required AWS service quotas