Alibaba
If you use a firewall, you must configure it so that OKD can access the sites that it requires to function. You must always grant access to some sites, and you grant access to more if you use Red Hat Insights, the Telemetry service, a cloud to host your cluster, and certain build strategies.
Before you install OKD, you must configure your firewall to grant access to the sites that OKD requires. When using a firewall, make additional configurations to the firewall so that OKD can access the sites that it requires to function.
There are no special configuration considerations for services running on only controller nodes compared to worker nodes.
If your environment has a dedicated load balancer in front of your OKD cluster, review the allowlists between your firewall and load balancer to prevent unwanted network restrictions to your cluster. |
Set the following registry URLs for your firewall’s allowlist:
URL | Port | Function |
---|---|---|
|
443 |
Provides core container images |
|
443 |
Hosts a signature store that a container client requires for verifying images pulled from |
|
443 |
Hosts all the container images that are stored on the Red Hat Ecosystem Catalog, including core container images. |
|
443 |
Provides core container images |
|
443 |
Provides core container images |
|
443 |
Provides core container images |
|
443 |
Provides core container images |
|
443 |
Provides core container images |
|
443 |
Provides core container images |
|
443 |
Provides core container images |
|
443 |
Provides core container images |
|
443 |
The |
You can use the wildcards *.quay.io
and *.openshiftapps.com
instead of cdn.quay.io
and cdn0[1-6].quay.io
in your allowlist.
You can use the wildcard *.access.redhat.com
to simplify the configuration and ensure that all subdomains, including registry.access.redhat.com
, are allowed.
When you add a site, such as quay.io
, to your allowlist, do not add a wildcard entry, such as *.quay.io
, to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, image downloads are denied when the initial download request redirects to a hostname such as cdn01.quay.io
.
Set your firewall’s allowlist to include any site that provides resources for a language or framework that your builds require.
If you do not disable Telemetry, you must grant access to the following URLs to access Red Hat Insights:
URL | Port | Function |
---|---|---|
|
443 |
Required for Telemetry |
|
443 |
Required for Telemetry |
|
443 |
Required for Telemetry |
|
443 |
Required for Telemetry and for |
If you use Alibaba Cloud, Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) to host your cluster, you must grant access to the URLs that offer the cloud provider API and DNS for that cloud:
Cloud | URL | Port | Function |
---|---|---|---|
Alibaba |
|
443 |
Required to access Alibaba Cloud services and resources. Review the Alibaba endpoints_config.go file to find the exact endpoints to allow for the regions that you use. |
AWS |
|
443 |
Used to install and manage clusters in an AWS environment. |
Alternatively, if you choose to not use a wildcard for AWS APIs, you must include the following URLs in your allowlist: |
443 |
Required to access AWS services and resources. Review the AWS Service Endpoints in the AWS documentation to find the exact endpoints to allow for the regions that you use. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. This endpoint is always |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Used to install and manage clusters in an AWS environment. |
|
|
443 |
Required. Used to confirm quotas for deploying the service. |
|
|
443 |
Allows the assignment of metadata about AWS resources in the form of tags. |
|
|
443 |
Used to provide access to CloudFront. If you use the AWS Security Token Service (STS) and the private S3 bucket, you must provide access to CloudFront. |
|
GCP |
|
443 |
Required to access GCP services and resources. Review Cloud Endpoints in the GCP documentation to find the endpoints to allow for your APIs. |
|
443 |
Required to access your GCP account. |
|
Microsoft Azure |
|
443 |
Required to access Microsoft Azure services and resources. Review the Microsoft Azure REST API reference in the Microsoft Azure documentation to find the endpoints to allow for your APIs. |
|
443 |
Required to download Ignition files. |
|
|
443 |
Required to access Microsoft Azure services and resources. Review the Azure REST API reference in the Microsoft Azure documentation to find the endpoints to allow for your APIs. |
Allowlist the following URLs:
URL | Port | Function |
---|---|---|
|
443 |
Required to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator needs only a single functioning source. |
|
443 |
A source of release image signatures, although the Cluster Version Operator needs only a single functioning source. |
|
443 |
Required to access the default cluster routes unless you set an ingress wildcard during installation. |
|
443 |
Required to access Quay image content in AWS. |
|
443 |
Required both for your cluster token and to check if updates are available for the cluster. |
|
443 |
Required to download Fedora CoreOS (FCOS) images. |
|
443 |
Required for your cluster token. |
|
443 |
The |
Operators require route access to perform health checks. Specifically, the
authentication and web console Operators connect to two routes to verify that
the routes work. If you are the cluster administrator and do not want to allow
*.apps.<cluster_name>.<base_domain>
, then allow these routes:
oauth-openshift.apps.<cluster_name>.<base_domain>
console-openshift-console.apps.<cluster_name>.<base_domain>
, or the hostname
that is specified in the spec.route.hostname
field of the
consoles.operator/cluster
object if the field is not empty.
Allowlist the following URLs for optional third-party content:
URL | Port | Function |
---|---|---|
|
443 |
Required for all third-party images and certified operators. |
|
443 |
Provides access to container images hosted on |
|
443 |
Required for Sonatype Nexus, F5 Big IP operators. |
If you use a default Red Hat Network Time Protocol (NTP) server allow the following URLs:
1.rhel.pool.ntp.org
2.rhel.pool.ntp.org
3.rhel.pool.ntp.org
If you do not use a default Red Hat NTP server, verify the NTP server for your platform and allow it in your firewall. |
The network flow matrix describes the ingress flows to OKD services. The network information in the matrix is accurate for both bare-metal and cloud environments. Use the information in the network flow matrix to help you manage ingress traffic. You can restrict ingress traffic to essential flows to improve network security.
To view or download the raw CSV content, see this resource.
Additionally, consider the following dynamic port ranges when managing ingress traffic:
9000-9999
: Host level services
30000-32767
: Kubernetes node ports
49152-65535
: Dynamic or private ports
The network flow matrix describes ingress traffic flows for a base OKD installation. It does not describe network flows for additional components, such as optional Operators available from the Red Hat Marketplace. The matrix does not apply for Hosted-Control-Plane, MicroShift, or standalone clusters. |
Direction | Protocol | Port | Namespace | Service | Pod | Container | Node Role | Optional |
---|---|---|---|---|---|---|---|---|
Ingress |
TCP |
22 |
Host system service |
sshd |
master |
TRUE |
||
Ingress |
TCP |
53 |
openshift-dns |
dns-default |
dnf-default |
dns |
master |
FALSE |
Ingress |
TCP |
80 |
openshift-ingress |
router-default |
router-default |
router |
master |
FALSE |
Ingress |
TCP |
111 |
Host system service |
rpcbind |
master |
TRUE |
||
Ingress |
TCP |
443 |
openshift-ingress |
router-default |
router-default |
router |
master |
FALSE |
Ingress |
TCP |
1936 |
openshift-ingress |
router-default |
router-default |
router |
master |
FALSE |
Ingress |
TCP |
2379 |
openshift-etcd |
etcd |
etcd |
etcdctl |
master |
FALSE |
Ingress |
TCP |
2380 |
openshift-etcd |
healthz |
etcd |
etcd |
master |
FALSE |
Ingress |
TCP |
5050 |
openshift-machine-api |
ironic-proxy |
ironic-proxy |
master |
FALSE |
|
Ingress |
TCP |
6080 |
openshift-kube-apiserver |
kube-apiserver |
kube-apiserver-insecure-readyz |
master |
FALSE |
|
Ingress |
TCP |
6180 |
openshift-machine-api |
metal3-state |
metal3 |
metal3-httpd |
master |
FALSE |
Ingress |
TCP |
6183 |
openshift-machine-api |
metal3-state |
metal3 |
metal3-httpd |
master |
FALSE |
Ingress |
TCP |
6385 |
openshift-machine-api |
ironic-proxy |
ironic-proxy |
master |
FALSE |
|
Ingress |
TCP |
6388 |
openshift-machine-api |
metal3-state |
metal3 |
metal3-httpd |
master |
FALSE |
Ingress |
TCP |
6443 |
openshift-kube-apiserver |
apiserver |
kube-apiserver |
kube-apiserver |
master |
FALSE |
Ingress |
TCP |
8080 |
openshift-network-operator |
network-operator |
network-operator |
master |
FALSE |
|
Ingress |
TCP |
8798 |
openshift-machine-config-operator |
machine-config-daemon |
machine-config-daemon |
machine-config-daemon |
master |
FALSE |
Ingress |
TCP |
9001 |
openshift-machine-config-operator |
machine-config-daemon |
machine-config-daemon |
kube-rbac-proxy |
master |
FALSE |
Ingress |
TCP |
9099 |
openshift-cluster-version |
cluster-version-operator |
cluster-version-operator |
cluster-version-operator |
master |
FALSE |
Ingress |
TCP |
9100 |
openshift-monitoring |
node-exporter |
node-exporter |
kube-rbac-proxy |
master |
FALSE |
Ingress |
TCP |
9103 |
openshift-ovn-kubernetes |
ovn-kubernetes-node |
ovnkube-node |
kube-rbac-proxy-node |
master |
FALSE |
Ingress |
TCP |
9104 |
openshift-network-operator |
metrics |
network-operator |
network-operator |
master |
FALSE |
Ingress |
TCP |
9105 |
openshift-ovn-kubernetes |
ovn-kubernetes-node |
ovnkube-node |
kube-rbac-proxy-ovn-metrics |
master |
FALSE |
Ingress |
TCP |
9107 |
openshift-ovn-kubernetes |
egressip-node-healthcheck |
ovnkube-node |
ovnkube-controller |
master |
FALSE |
Ingress |
TCP |
9108 |
openshift-ovn-kubernetes |
ovn-kubernetes-control-plane |
ovnkube-control-plane |
kube-rbac-proxy |
master |
FALSE |
Ingress |
TCP |
9192 |
openshift-cluster-machine-approver |
machine-approver |
machine-approver |
kube-rbac-proxy |
master |
FALSE |
Ingress |
TCP |
9258 |
openshift-cloud-controller-manager-operator |
machine-approver |
cluster-cloud-controller-manager |
cluster-cloud-controller-manager |
master |
FALSE |
Ingress |
TCP |
9444 |
openshift-kni-infra |
haproxy |
haproxy |
master |
FALSE |
|
Ingress |
TCP |
9445 |
openshift-kni-infra |
haproxy |
haproxy |
master |
FALSE |
|
Ingress |
TCP |
9447 |
openshift-machine-api |
metal3-baremetal-operator |
master |
FALSE |
||
Ingress |
TCP |
9537 |
Host system service |
crio-metrics |
master |
FALSE |
||
Ingress |
TCP |
9637 |
openshift-machine-config-operator |
kube-rbac-proxy-crio |
kube-rbac-proxy-crio |
kube-rbac-proxy-crio |
master |
FALSE |
Ingress |
TCP |
9978 |
openshift-etcd |
etcd |
etcd |
etcd-metrics |
master |
FALSE |
Ingress |
TCP |
9979 |
openshift-etcd |
etcd |
etcd |
etcd-metrics |
master |
FALSE |
Ingress |
TCP |
9980 |
openshift-etcd |
etcd |
etcd |
etcd |
master |
FALSE |
Ingress |
TCP |
10250 |
Host system service |
kubelet |
master |
FALSE |
||
Ingress |
TCP |
10256 |
openshift-ovn-kubernetes |
ovnkube |
ovnkube |
ovnkube-controller |
master |
FALSE |
Ingress |
TCP |
10257 |
openshift-kube-controller-manager |
kube-controller-manager |
kube-controller-manager |
kube-controller-manager |
master |
FALSE |
Ingress |
TCP |
10258 |
openshift-cloud-controller-manager-operator |
cloud-controller |
cloud-controller-manager |
cloud-controller-manager |
master |
FALSE |
Ingress |
TCP |
10259 |
openshift-kube-scheduler |
scheduler |
openshift-kube-scheduler |
kube-scheduler |
master |
FALSE |
Ingress |
TCP |
10260 |
openshift-cloud-controller-manager-operator |
cloud-controller |
cloud-controller-manager |
cloud-controller-manager |
master |
FALSE |
Ingress |
TCP |
10300 |
openshift-cluster-csi-drivers |
csi-livenessprobe |
csi-driver-node |
csi-driver |
master |
FALSE |
Ingress |
TCP |
10309 |
openshift-cluster-csi-drivers |
csi-node-driver |
csi-driver-node |
csi-node-driver-registrar |
master |
FALSE |
Ingress |
TCP |
10357 |
openshift-kube-apiserver |
openshift-kube-apiserver-healthz |
kube-apiserver |
kube-apiserver-check-endpoints |
master |
FALSE |
Ingress |
TCP |
17697 |
openshift-kube-apiserver |
openshift-kube-apiserver-healthz |
kube-apiserver |
kube-apiserver-check-endpoints |
master |
FALSE |
Ingress |
TCP |
18080 |
openshift-kni-infra |
coredns |
coredns |
master |
FALSE |
|
Ingress |
TCP |
22623 |
openshift-machine-config-operator |
machine-config-server |
machine-config-server |
machine-config-server |
master |
FALSE |
Ingress |
TCP |
22624 |
openshift-machine-config-operator |
machine-config-server |
machine-config-server |
machine-config-server |
master |
FALSE |
Ingress |
UDP |
53 |
openshift-dns |
dns-default |
dnf-default |
dns |
master |
FALSE |
Ingress |
UDP |
111 |
Host system service |
rpcbind |
master |
TRUE |
||
Ingress |
UDP |
6081 |
openshift-ovn-kubernetes |
ovn-kubernetes geneve |
master |
FALSE |
||
Ingress |
TCP |
22 |
Host system service |
sshd |
worker |
TRUE |
||
Ingress |
TCP |
53 |
openshift-dns |
dns-default |
dnf-default |
dns |
worker |
FALSE |
Ingress |
TCP |
80 |
openshift-ingress |
router-default |
router-default |
router |
worker |
FALSE |
Ingress |
TCP |
111 |
Host system service |
rpcbind |
worker |
TRUE |
||
Ingress |
TCP |
443 |
openshift-ingress |
router-default |
router-default |
router |
worker |
FALSE |
Ingress |
TCP |
1936 |
openshift-ingress |
router-default |
router-default |
router |
worker |
FALSE |
Ingress |
TCP |
8798 |
openshift-machine-config-operator |
machine-config-daemon |
machine-config-daemon |
machine-config-daemon |
worker |
FALSE |
Ingress |
TCP |
9001 |
openshift-machine-config-operator |
machine-config-daemon |
machine-config-daemon |
kube-rbac-proxy |
worker |
FALSE |
Ingress |
TCP |
9100 |
openshift-monitoring |
node-exporter |
node-exporter |
kube-rbac-proxy |
worker |
FALSE |
Ingress |
TCP |
9103 |
openshift-ovn-kubernetes |
ovn-kubernetes-node |
ovnkube-node |
kube-rbac-proxy-node |
worker |
FALSE |
Ingress |
TCP |
9105 |
openshift-ovn-kubernetes |
ovn-kubernetes-node |
ovnkube-node |
kube-rbac-proxy-ovn-metrics |
worker |
FALSE |
Ingress |
TCP |
9107 |
openshift-ovn-kubernetes |
egressip-node-healthcheck |
ovnkube-node |
ovnkube-controller |
worker |
FALSE |
Ingress |
TCP |
9537 |
Host system service |
crio-metrics |
worker |
FALSE |
||
Ingress |
TCP |
9637 |
openshift-machine-config-operator |
kube-rbac-proxy-crio |
kube-rbac-proxy-crio |
kube-rbac-proxy-crio |
worker |
FALSE |
Ingress |
TCP |
10250 |
Host system service |
kubelet |
worker |
FALSE |
||
Ingress |
TCP |
10256 |
openshift-ovn-kubernetes |
ovnkube |
ovnkube |
ovnkube-controller |
worker |
TRUE |
Ingress |
TCP |
10300 |
openshift-cluster-csi-drivers |
csi-livenessprobe |
csi-driver-node |
csi-driver |
worker |
FALSE |
Ingress |
TCP |
10309 |
openshift-cluster-csi-drivers |
csi-node-driver |
csi-driver-node |
csi-node-driver-registrar |
worker |
FALSE |
Ingress |
TCP |
18080 |
openshift-kni-infra |
coredns |
coredns |
worker |
FALSE |
|
Ingress |
UDP |
53 |
openshift-dns |
dns-default |
dnf-default |
dns |
worker |
FALSE |
Ingress |
UDP |
111 |
Host system service |
rpcbind |
worker |
TRUE |
||
Ingress |
UDP |
6081 |
openshift-ovn-kubernetes |
ovn-kubernetes geneve |
worker |
FALSE |