Merge pull request #87723 from michaelryanmcneill/OSDOCS-13246

OSDOCS-13246: Clean up egress list for ROSA Classic/OSD-AWS

Author: stevsmit

modules/osd-aws-privatelink-firewall-prerequisites.adoc

@@ -65,6 +65,18 @@ endif::[]
 |443
 |Provides core container images.
 
+|`cdn04.quay.io`
+|443
+|Provides core container images.
+
+|`cdn05.quay.io`
+|443
+|Provides core container images.
+
+|`cdn06.quay.io`
+|443
+|Provides core container images.
+
 |`sso.redhat.com`
 |443
 |Required. The `https://console.redhat.com/openshift` site uses authentication from `sso.redhat.com` to download the pull secret and use Red{nbsp}Hat SaaS solutions to facilitate monitoring of your subscriptions, cluster inventory, chargeback reporting, and so on.
@@ -77,10 +89,6 @@ endif::[]
 |443
 |Provides core container images.
 
-|`openshift.org`
-|443
-|Provides {op-system-first} images.
-
 |`registry.access.redhat.com`
 |443
 |Hosts all the container images that are stored on the Red{nbsp}Hat Ecosytem Catalog. Additionally, the registry provides access to the `odo` CLI tool that helps developers build on OpenShift and Kubernetes.
@@ -105,50 +113,33 @@ endif::[]
 |443
 |Provides core container images as a fallback when quay.io is not available.
 
-|`.q1w2.quay.rhcloud.com`
-|443
-|Provides core container images as a fallback when quay.io is not available.
-
-|`www.okd.io`
-|443
-|The `openshift.org` site redirects through `www.okd.io`.
-
-|`www.redhat.com`
-|443
-|The `sso.redhat.com` site redirects through `www.redhat.com`.
-
-|`aws.amazon.com`
-|443
-|The `iam.amazonaws.com` and `sts.amazonaws.com` sites redirect through `aws.amazon.com`.
-
 |`catalog.redhat.com`
 |443
 |The `registry.access.redhat.com` and `https://registry.redhat.io` sites redirect through `catalog.redhat.com`.
 
-|`dvbwgdztaeq9o.cloudfront.net` ^[1]^
+|`oidc.op1.openshiftapps.com`
 |443
 |Used by ROSA for STS implementation with managed OIDC configuration.
 
 ifdef::fedramp[]
 |`time-a-g.nist.gov`
-|123 ^[2]^
+|123 ^[1]^
 |Allows NTP traffic for FedRAMP.
 
 |`time-a-wwv.nist.gov`
-|123 ^[2]^
+|123 ^[1]^
 |Allows NTP traffic for FedRAMP.
 
 |`time-a-b.nist.gov`
-|123 ^[2]^
+|123 ^[1]^
 |Allows NTP traffic for FedRAMP.
 endif::fedramp[]
 |===
 +
 [.small]
 --
-1. The string of alphanumeric characters before `cloudfront.net` could change if there is a major cloudfront outage that requires redirecting the resource.
 ifdef::fedramp[]
-2. Both TCP and UDP ports.
+1. Both TCP and UDP ports.
 endif::fedramp[]
 --
 +
@@ -174,10 +165,6 @@ endif::fedramp[]
 |443
 |Required for telemetry and Red{nbsp}Hat Insights.
 
-|`cloud.redhat.com/api/ingress`
-|443
-|Required for telemetry and Red{nbsp}Hat Insights.
-
 |`observatorium-mst.api.openshift.com`
 |443
 |Required for managed OpenShift-specific telemetry.
@@ -259,11 +246,7 @@ Alternatively, if you choose to not use a wildcard for Amazon Web Services (AWS)
 
 |`mirror.openshift.com`
 |443
-|Used to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator (CVO) needs only a single functioning source.
-
-|`storage.googleapis.com/openshift-release` (Recommended)
-|443
-|Alternative site to mirror.openshift.com/. Used to download platform release signatures that are used by the cluster to know what images to pull from quay.io.
+|Used to access mirrored installation content and images. This site is also a source of release image signatures.
 
 |`api.openshift.com`
 |443
@@ -320,27 +303,6 @@ OR
 |The SFTP server used by `must-gather-operator` to upload diagnostic logs to help troubleshoot issues with the cluster.
 |===
 
-. Allowlist the following URLs for optional third-party content:
-+
-[cols="6,1,6",options="header"]
-|===
-|Domain | Port | Function
-|`registry.connect.redhat.com`
-| 443
-| Required for all third-party-images and certified operators.
-
-|`rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com`
-| 443
-| Provides access to container images hosted on `registry.connect.redhat.com`
-
-|`oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com`
-| 443
-| Required for Sonatype Nexus, F5 Big IP operators.
-|===
-
-. Allowlist any site that provides resources for a language or framework that your builds require.
-. Allowlist any outbound URLs that depend on the languages and frameworks used in OpenShift. See link:https://access.redhat.com/solutions/2998411[OpenShift Outbound URLs to Allow] for a list of recommended URLs to be allowed on the firewall or proxy.
-
 ifeval::["{context}" == "rosa-sts-aws-prereqs"]
 :!fedramp:
 :!rosa-classic-sts: