// Module included in the following assemblies:
//
// * installing/install_config/configuring-firewall.adoc
// * installing/installing-oci-agent-based-installer.adoc

ifeval::["{context}" == "installing-oci-agent-based-installer"]
:oci-agent:
endif::[]

:_mod-docs-content-type: PROCEDURE
[id="configuring-firewall-module_{context}"]
= Configuring your firewall for {product-title}

[role="_abstract"]
Before you install {product-title}, you must configure your firewall to grant access to the sites that {product-title} requires.

ifndef::oci-agent[]
There are no special configuration considerations for services running on only controller nodes compared to compute nodes.
endif::oci-agent[]

ifdef::oci-agent[]
For a disconnected environment, you must mirror content from both Red{nbsp}Hat and Oracle. This environment requires that you create firewall rules to expose your firewall to specific ports and registries.
endif::oci-agent[]

[NOTE]
====
If your environment has a dedicated load balancer in front of your {product-title} cluster, review the allowlists between your firewall and load balancer to prevent unwanted network restrictions to your cluster.
====

.Procedure

. Allowlist the following container registry URLs for cluster installation and upgrades:
+
[cols="3,2,4",options="header"]
|===
|URL | Port | Function

|`registry.redhat.io`
|443
|Provides core container images

|`access.redhat.com`
|443
|Hosts a signature store that a container client requires for verifying images pulled from `registry.access.redhat.com`. In a firewall environment, ensure that this resource is on the allowlist.

|`registry.access.redhat.com`
|443
|Hosts all the container images that are stored on the Red Hat Ecosystem Catalog, including core container images.

|`quay.io`
|443
|Provides core container images

|`cdn.quay.io`
|443
|Provides core container images

|`cdn01.quay.io`
|443
|Provides core container images

|`cdn02.quay.io`
|443
|Provides core container images

|`cdn03.quay.io`
|443
|Provides core container images

|`cdn04.quay.io`
|443
|Provides core container images

|`cdn05.quay.io`
|443
|Provides core container images

|`cdn06.quay.io`
|443
|Provides core container images

|`icr.io`
|443
|Provides IBM Cloud Pak container images. This domain is only required if you use IBM Cloud Paks.

|`cp.icr.io`
|443
|Provides IBM Cloud Pak container images. This domain is only required if you use IBM Cloud Paks.
|===
+
* You can use the wildcard `*.quay.io` instead of `cdn.quay.io` and `cdn0[1-6].quay.io` in your allowlist.
* You can use the wildcard `*.access.redhat.com` to simplify the configuration and ensure that all subdomains, including `registry.access.redhat.com`, are allowed.
* When adding a site such as `quay.io` to your allowlist, do not add a wildcard entry such as `*.quay.io` to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, image downloads are denied when the initial download request redirects to a hostname such as `cdn01.quay.io`.

. Allowlist the following URLs to enable cluster access, authentication, and updates:
+
[cols="3,2,4",options="header"]
|===
|URL | Port | Function

|`*.apps.<cluster_name>.<base_domain>`
|443
|Allowlist these URLs to enable cluster access, authentication, and updates.

|`api.openshift.com`
|443
|API endpoint for cluster tokens and update checks.

|`console.redhat.com`
|443
|Authentication service for cluster tokens.

|`sso.redhat.com`
|443
|The `https://console.redhat.com` site uses authentication from `sso.redhat.com`
|===
+
For egress traffic, Operators require route access to perform health checks to establish a connection for reaching endpoints. The authentication and web console Operators connect to two routes to verify functionality. Cluster administrators who do not want to allow `*.apps.<cluster_name>.<base_domain>`, must allow the following routes:
+
* `oauth-openshift.apps.<cluster_name>.<base_domain>`
* `canary-openshift-ingress-canary.apps.<cluster_name>.<base_domain>`
* `console-openshift-console.apps.<cluster_name>.<base_domain>`, or the hostname
that is specified in the `spec.route.hostname` field of the
`consoles.operator/cluster` object if the field is not empty.

. Allowlist the following registry URLs that host related artifacts for cluster installation and upgrades, such as installation content, release images, and client tools:
+
[cols="3,2,4",options="header"]
|===
|URL | Port | Function

|`mirror.openshift.com`
|443
|Required to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator needs only a single functioning source.

|`quayio-production-s3.s3.amazonaws.com`
|443
|Required to access Quay image content in AWS.

// |`registry.access.redhat.com`
// |443
// |Required for `odo` CLI.

|`rhcos.mirror.openshift.com`
|443
|Required to download {op-system-first} images.

|`storage.googleapis.com/openshift-release`
|443
|A source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
|===

. Set your firewall's allowlist to include any site that provides resources for a language or framework that your builds require.

. If you do not disable Telemetry, you must grant access to the following URLs to access Telemetry and {red-hat-lightspeed}:
+
[cols="3,2,4",options="header"]
|===
|URL | Port | Function

|`cert-api.access.redhat.com`
|443
|Required for Telemetry

|`api.access.redhat.com`
|443
|Required for Telemetry

|`infogw.api.openshift.com`
|443
|Required for Telemetry

|`console.redhat.com`
|443
|Required for Telemetry and for `insights-operator`
|===

ifdef::oci-agent[]
. Set your firewall's allowlist to include the following registry URLs:
+
[cols="3,2,4",options="header"]
|===
|URL | Port | Function

|`api.openshift.com`
|443
|Required both for your cluster token and to check if updates are available for the cluster.

|`rhcos.mirror.openshift.com`
|443
|Required to download {op-system-first} images.
|===

. Set your firewall's allowlist to include the following external URLs. Each repository URL hosts {oci} containers. Consider mirroring images to as few repositories as possible to reduce any performance issues.
+
[cols="3,2,4",options="header"]
|===
|URL | Port | Function

|`k8s.gcr.io`
|port
|A Kubernetes registry that hosts container images for a community-based image registry. This image registry is hosted on a custom Google Container Registry (GCR) domain.

|`ghcr.io`
|port
|A GitHub image registry where you can store and manage Open Container Initiative images. Requires an access token to publish, install, and delete private, internal, and public packages.

|`storage.googleapis.com`
|443
|A source of release image signatures, although the Cluster Version Operator needs only a single functioning source.

|`registry.k8s.io`
|port
|Replaces the `k8s.gcr.io` image registry because the `k8s.gcr.io` image registry does not support other platforms and vendors.
|===
endif::oci-agent[]

ifndef::oci-agent[]
. If you use {alibaba}, {aws-first}, {azure-first}, or {gcp-first} to host your cluster, you must grant access to the URLs that offer the cloud provider API and DNS for that cloud:
+
[cols="2a,8a,2a,8a",options="header"]
|===
|Cloud |URL | Port |Function

|Alibaba
|`*.aliyuncs.com`
|443
|Required to access Alibaba Cloud services and resources. Review the link:https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/sdk/endpoints/endpoints_config.go?spm=a2c4g.11186623.0.0.47875873ciGnC8&file=endpoints_config.go[Alibaba endpoints_config.go file] to find the exact endpoints to allow for the regions that you use.

.17+|AWS
|`aws.amazon.com`
|443
|Used to install and manage clusters in an AWS environment.

|`*.amazonaws.com`

Alternatively, if you choose to not use a wildcard for AWS APIs, you must include the following URLs in your allowlist:
|443
|Required to access AWS services and resources. Review the link:https://docs.aws.amazon.com/general/latest/gr/rande.html[AWS Service Endpoints] in the AWS documentation to find the exact endpoints to allow for the regions that you use.

|`ec2.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`events.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`iam.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`route53.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`*.s3.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`*.s3.<aws_region>.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`*.s3.dualstack.<aws_region>.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`sts.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`sts.<aws_region>.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`tagging.us-east-1.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment. This endpoint is always `us-east-1`, regardless of the region the cluster is deployed in.

|`ec2.<aws_region>.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`elasticloadbalancing.<aws_region>.amazonaws.com`
|443
|Used to install and manage clusters in an AWS environment.

|`servicequotas.<aws_region>.amazonaws.com`
|443
|Required. Used to confirm quotas for deploying the service.

|`tagging.<aws_region>.amazonaws.com`
|443
|Allows the assignment of metadata about AWS resources in the form of tags.

|`*.cloudfront.net`
|443
|Used to provide access to CloudFront. If you use the AWS Security Token Service (STS) and the private S3 bucket, you must provide access to CloudFront.

.2+|GCP
|`*.googleapis.com`
|443
|Required to access {gcp-short} services and resources. Review link:https://cloud.google.com/endpoints/[Cloud Endpoints] in the {gcp-short} documentation to find the endpoints to allow for your APIs.

|`accounts.google.com`
|443
| Required to access your {gcp-short} account.

.3+|Microsoft Azure
|`management.azure.com`
|443
|Required to access Microsoft Azure services and resources. Review the link:https://docs.microsoft.com/en-us/rest/api/azure/[Microsoft Azure REST API reference] in the Microsoft Azure documentation to find the endpoints to allow for your APIs.

|`*.blob.core.windows.net`
|443
|Required to download Ignition files.

|`login.microsoftonline.com`
|443
|Required to access Microsoft Azure services and resources. Review the link:https://docs.microsoft.com/en-us/rest/api/azure/[Azure REST API reference] in the Microsoft Azure documentation to find the endpoints to allow for your APIs.

|===

. Allowlist the following URL for optional third-party content:
+
[cols="3,2,4",options="header"]
|===
|URL | Port | Function

|`registry.connect.redhat.com`
|443
|Required for all third-party images and certified operators.
|===

. If you use a default Red Hat Network Time Protocol (NTP) server, allow the following URLs. NTP operates on User Datagram Protocol (UDP) port 123, so this port must be opened on the firewall. 
+
[cols="3,2,4",options="header"]
|===
|URL | Port | Function

|`1.rhel.pool.ntp.org`
|123
|Provides NTP services for time synchronization.

|`2.rhel.pool.ntp.org`
|123
|Provides NTP services for time synchronization.

|`3.rhel.pool.ntp.org`
|123
|Provides NTP services for time synchronization.
|===
+
[NOTE]
====
If you do not use a default Red Hat NTP server, verify the NTP server for your platform and allow it in your firewall.
====
endif::oci-agent[]

ifeval::["{context}" == "installing-oci-agent-based-installer"]
:!oci-agent:
endif::[]
