Skip to content

Commit 8a748fc

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #75197 from EricPonvelle/OSDOCS#10345_Firewall-Prereqs
OSDOCS#10345: Restructured the Firewall Prereq modules
2 parents 520c988 + 9759711 commit 8a748fc

File tree

5 files changed

+194
-37
lines changed

5 files changed

+194
-37
lines changed

‎modules/osd-aws-privatelink-firewall-prerequisites.adoc

Lines changed: 43 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -3,27 +3,40 @@
33
// * osd_planning/aws-ccs.adoc
44
// * rosa_install_access_delete_clusters/rosa_getting_started_iam/rosa-aws-prereqs.adoc
55
// * rosa_planning/rosa-sts-aws-prereqs.adoc
6-
// * rosa_planning/rosa-hcp-prereqs.adoc
76

87
ifeval::["{context}" == "rosa-sts-aws-prereqs"]
98
:fedramp:
9+
:rosa-classic-sts:
1010
endif::[]
11-
ifeval::["{context}" == "rosa-hcp-aws-prereqs"]
12-
:fedramp:
11+
ifeval::["{context}" == "aws-ccs"]
12+
:osd:
13+
endif::[]
14+
ifeval::["{context}" == "prerequisites"]
15+
:rosa-classic:
1316
endif::[]
1417

1518
:_mod-docs-content-type: PROCEDURE
19+
ifdef::rosa-classic-sts[]
20+
[id="rosa-classic-firewall-prerequisites_{context}"]
21+
= ROSA Classic
22+
endif::rosa-classic-sts[]
23+
ifndef::rosa-classic-sts[]
1624
[id="osd-aws-privatelink-firewall-prerequisites_{context}"]
1725
= AWS firewall prerequisites
1826

27+
If you are using a firewall to control egress traffic from {product-title}, you must configure your firewall to grant access to the certain domain and port combinations below. {product-title} requires this access to provide a fully managed OpenShift service.
28+
endif::rosa-classic-sts[]
29+
1930
ifdef::openshift-rosa[]
2031
[IMPORTANT]
2132
====
2233
Only ROSA clusters deployed with PrivateLink can use a firewall to control egress traffic.
2334
====
2435
endif::[]
2536

26-
This section provides the necessary details that enable you to control egress traffic from your {product-title} cluster. If you are using a firewall to control egress traffic, you must configure your firewall to grant access to the domain and port combinations below. {product-title} requires this access to provide a fully managed OpenShift service.
37+
.Prerequisites
38+
39+
* You have configured an Amazon S3 gateway endpoint in your AWS Virtual Private Cloud (VPC). This endpoint is required to complete requests from the cluster to the Amazon S3 service.
2740
2841
.Procedure
2942

@@ -40,7 +53,15 @@ This section provides the necessary details that enable you to control egress tr
4053
|443
4154
|Provides core container images.
4255

43-
|`.quay.io`
56+
|`cdn01.quay.io`
57+
|443
58+
|Provides core container images.
59+
60+
|`cdn02.quay.io`
61+
|443
62+
|Provides core container images.
63+
64+
|`cdn03.quay.io`
4465
|443
4566
|Provides core container images.
4667

@@ -68,10 +89,14 @@ This section provides the necessary details that enable you to control egress tr
6889
|443
6990
|Provides {op-system-first} images.
7091

71-
|`registry.access.redhat.com` ^[1]^
92+
|`registry.access.redhat.com`
7293
|443
7394
|Hosts all the container images that are stored on the Red Hat Ecosytem Catalog. Additionally, the registry provides access to the `odo` CLI tool that helps developers build on OpenShift and Kubernetes.
7495

96+
|`access.redhat.com`
97+
|443
98+
|Required. Hosts a signature store that a container client requires for verifying images when pulling them from `registry.access.redhat.com`.
99+
75100
|`registry.connect.redhat.com`
76101
|443
77102
|Required for all third-party images and certified Operators.
@@ -108,39 +133,33 @@ This section provides the necessary details that enable you to control egress tr
108133
|443
109134
|The `registry.access.redhat.com` and `https://registry.redhat.io` sites redirect through `catalog.redhat.com`.
110135

111-
|`dvbwgdztaeq9o.cloudfront.net` ^[2]^
136+
|`dvbwgdztaeq9o.cloudfront.net` ^[1]^
112137
|443
113138
|Used by ROSA for STS implementation with managed OIDC configuration.
114139

115140
ifdef::fedramp[]
116141
|`time-a-g.nist.gov`
117-
|123 ^[3]^
142+
|123 ^[2]^
118143
|Allows NTP traffic for FedRAMP.
119144

120145
|`time-a-wwv.nist.gov`
121-
|123 ^[3]^
146+
|123 ^[2]^
122147
|Allows NTP traffic for FedRAMP.
123148

124149
|`time-a-b.nist.gov`
125-
|123 ^[3]^
150+
|123 ^[2]^
126151
|Allows NTP traffic for FedRAMP.
127152
endif::fedramp[]
128153
|===
129154
+
130155
[.small]
131156
--
132-
1. In a firewall environment, ensure that the `access.redhat.com` resource is on the allowlist. This resource hosts a signature store that a container client requires for verifying images when pulling them from `registry.access.redhat.com`.
133-
2. The string of alphanumeric characters before `cloudfront.net` could change if there is a major cloudfront outage that requires redirecting the resource.
157+
1. The string of alphanumeric characters before `cloudfront.net` could change if there is a major cloudfront outage that requires redirecting the resource.
134158
ifdef::fedramp[]
135-
3. Both TCP and UDP ports.
159+
2. Both TCP and UDP ports.
136160
endif::fedramp[]
137-
138161
--
139162
+
140-
When you add a site such as `quay.io` to your allowlist, do not add a wildcard entry such as `.quay.io` to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, then image downloads are denied when the initial download request is redirected to a host name such as `cdn01.quay.io`.
141-
+
142-
CDN host names, such as `cdn01.quay.io`, are covered when you add a wildcard entry, such as `.quay.io`, in your allowlist.
143-
144163
. Allowlist the following telemetry URLs:
145164
+
146165
[cols="6,1,6",options="header"]
@@ -327,26 +346,16 @@ OR
327346
| Required for Sonatype Nexus, F5 Big IP operators.
328347
|===
329348

330-
. If you did not allow a wildcard for Amazon Web Services (AWS) APIs, you must also allow the S3 bucket used for the internal OpenShift registry. To retrieve that endpoint, run the following command after the cluster is successfully provisioned:
331-
+
332-
[source,terminal]
333-
----
334-
$ oc -n openshift-image-registry get pod -l docker-registry=default -o json | jq '.items[].spec.containers[].env[] | select(.name=="REGISTRY_STORAGE_S3_BUCKET")'
335-
----
336-
+
337-
The S3 endpoint should be in the following format:
338-
+
339-
[source,terminal]
340-
----
341-
'<cluster-name>-<random-string>-image-registry-<cluster-region>-<random-string>.s3.dualstack.<cluster-region>.amazonaws.com'.
342-
----
343-
344349
. Allowlist any site that provides resources for a language or framework that your builds require.
345350
. Allowlist any outbound URLs that depend on the languages and frameworks used in OpenShift. See link:https://access.redhat.com/solutions/2998411[OpenShift Outbound URLs to Allow] for a list of recommended URLs to be allowed on the firewall or proxy.
346351

347352
ifeval::["{context}" == "rosa-sts-aws-prereqs"]
348353
:!fedramp:
354+
:!rosa-classic-sts:
349355
endif::[]
350-
ifeval::["{context}" == "rosa-hcp-aws-prereqs"]
351-
:!fedramp:
356+
ifeval::["{context}" == "aws-ccs"]
357+
:!osd:
358+
endif::[]
359+
ifeval::["{context}" == "prerequisites"]
360+
:!rosa-classic:
352361
endif::[]

‎modules/rosa-hcp-firewall-prerequisites.adoc

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_planning/rosa-sts-aws-prereqs.adoc
4+
// * rosa_planning/rosa-hcp-prereqs.adoc
5+
6+
ifeval::["{context}" == "rosa-sts-aws-prereqs"]
7+
:rosa-classic-sts:
8+
endif::[]
9+
ifeval::["{context}" == "rosa-hcp-aws-prereqs"]
10+
:hcp:
11+
endif::[]
12+
13+
[id="rosa-hcp-firewall-prerequisites_{context}"]
14+
// Conditionals are to change the title when displayed on the rosa-sts-aws-prereqs page
15+
ifdef::rosa-classic-sts[]
16+
= {hcp-title}
17+
endif::rosa-classic-sts[]
18+
ifndef::rosa-classic-sts[]
19+
= AWS firewall prerequisites
20+
21+
If you are using a firewall to control egress traffic from {product-title}, you must configure your firewall to grant access to the certain domain and port combinations below. {product-title} requires this access to provide a fully managed OpenShift service.
22+
endif::rosa-classic-sts[]
23+
24+
.Prerequisites
25+
26+
* You have configured an Amazon S3 gateway endpoint in your AWS Virtual Private Cloud (VPC). This endpoint is required to complete requests from the cluster to the Amazon S3 service.
27+
28+
.Procedure
29+
30+
. Allowlist the following URLs that are used to download and install packages and tools:
31+
+
32+
[cols="6,1,6",options="header"]
33+
|===
34+
|Domain | Port | Function
35+
|`quay.io`
36+
|443
37+
|Provides core container images.
38+
39+
|`cdn01.quay.io`
40+
|443
41+
|Provides core container images.
42+
43+
|`cdn02.quay.io`
44+
|443
45+
|Provides core container images.
46+
47+
|`cdn03.quay.io`
48+
|443
49+
|Provides core container images.
50+
51+
|`quayio-production-s3.s3.amazonaws.com`
52+
|443
53+
|Provides core container images.
54+
55+
|`registry.redhat.io`
56+
|443
57+
|Provides core container images.
58+
59+
|`registry.access.redhat.com`
60+
|443
61+
|Required. Hosts all the container images that are stored on the Red Hat Ecosytem Catalog. Additionally, the registry provides access to the `odo` CLI tool that helps developers build on OpenShift and Kubernetes.
62+
63+
|`access.redhat.com`
64+
|443
65+
|Required. Hosts a signature store that a container client requires for verifying images when pulling them from `registry.access.redhat.com`.
66+
67+
|`mirror.openshift.com`
68+
|443
69+
|Required. Used to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator (CVO) needs only a single functioning source.
70+
|===
71+
+
72+
. Allowlist the following telemetry URLs:
73+
+
74+
[cols="6,1,6",options="header"]
75+
|===
76+
|Domain | Port | Function
77+
|`infogw.api.openshift.com`
78+
|443
79+
|Required for telemetry.
80+
81+
|`console.redhat.com`
82+
|443
83+
|Required. Allows interactions between the cluster and OpenShift Console Manager to enable functionality, such as scheduling upgrades.
84+
85+
|`sso.redhat.com`
86+
|443
87+
|Required. The `https://console.redhat.com/openshift` site uses authentication from `sso.redhat.com` to download the pull secret and use Red Hat SaaS solutions to facilitate monitoring of your subscriptions, cluster inventory, chargeback reporting, etc.
88+
|===
89+
+
90+
Managed clusters require enabling telemetry to allow Red Hat to react more quickly to problems, better support the customers, and better understand how product upgrades impact clusters.
91+
For more information about how remote health monitoring data is used by Red Hat, see _About remote health monitoring_ in the _Additional resources_ section.
92+
93+
. Allowlist the following Amazon Web Services (AWS) API URls:
94+
+
95+
[cols="6,1,6",options="header"]
96+
|===
97+
|Domain | Port | Function
98+
99+
|`sts.<aws_region>.amazonaws.com` ^[1]^
100+
|443
101+
|Required. Used to access the AWS Secure Token Service (STS) regional endpoint. Ensure that you replace `<aws-region>` with the region that your cluster is deployed in.
102+
103+
|`sts.amazonaws.com` ^[2]^
104+
|443
105+
|See footnote. Used to access the AWS Secure Token Service (STS) global endpoint.
106+
|===
107+
+
108+
[.small]
109+
--
110+
1. This can also be accomplished by configuring a private interface endpoint in your AWS Virtual Private Cloud (VPC) to the regional AWS STS endpoint.
111+
2. The AWS STS global endpoint is only required to be allowed if you are running a version of OpenShift before 4.14.18 or 4.15.4. ROSA HCP version 4.14.18+, 4.15.4+, and 4.16.0+ use the AWS STS regional endpoint.
112+
--
113+
+
114+
115+
. Allowlist the following URLs for optional third-party content:
116+
+
117+
[cols="6,1,6",options="header"]
118+
|===
119+
|Domain | Port | Function
120+
|`registry.connect.redhat.com`
121+
| 443
122+
| Optional. Required for all third-party-images and certified operators.
123+
124+
|`rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com`
125+
| 443
126+
| Optional. Provides access to container images hosted on `registry.connect.redhat.com`.
127+
128+
|`oso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com`
129+
| 443
130+
| Optional. Required for Sonatype Nexus, F5 Big IP operators.
131+
|===
132+
133+
. Allowlist any site that provides resources for a language or framework that your builds require.
134+
. Allowlist any outbound URLs that depend on the languages and frameworks used in OpenShift. See link:https://access.redhat.com/solutions/2998411[OpenShift Outbound URLs to Allow] for a list of recommended URLs to be allowed on the firewall or proxy.
135+
136+
ifeval::["{context}" == "rosa-sts-aws-prereqs"]
137+
:!rosa-classic-sts:
138+
endif::[]
139+
ifeval::["{context}" == "rosa-hcp-aws-prereqs"]
140+
:!hcp:
141+
endif::[]

‎osd_planning/aws-ccs.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ include::modules/ccs-aws-customer-procedure.adoc[leveloffset=+1]
1515
include::modules/ccs-aws-scp.adoc[leveloffset=+1]
1616
include::modules/ccs-aws-iam.adoc[leveloffset=+1]
1717
include::modules/ccs-aws-provisioned.adoc[leveloffset=+1]
18-
include::modules/osd-aws-privatelink-firewall-prerequisites.adoc[leveloffset=+2]
18+
include::modules/osd-aws-privatelink-firewall-prerequisites.adoc[leveloffset=+1]
1919

2020
[role="_additional-resources"]
2121
.Additional resources

‎rosa_planning/rosa-hcp-prereqs.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ With the STS deployment model, Red Hat is no longer responsible for creating and
7373
* For every cluster, you must have the necessary operator roles. See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-operator-roles_rosa-sts-about-iam-resources[Cluster-specific Operator IAM role reference].
7474

7575
include::modules/rosa-aws-provisioned.adoc[leveloffset=+1]
76-
include::modules/osd-aws-privatelink-firewall-prerequisites.adoc[leveloffset=+1]
76+
include::modules/rosa-hcp-firewall-prerequisites.adoc[leveloffset=+1]
7777

7878
== Next steps
7979
* xref:../rosa_planning/rosa-sts-required-aws-service-quotas.adoc#rosa-sts-required-aws-service-quotas[Review the required AWS service quotas]

‎rosa_planning/rosa-sts-aws-prereqs.adoc

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,14 @@ With the STS deployment model, Red Hat is no longer responsible for creating and
7070
* For every cluster, you must have the necessary operator roles. See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-operator-roles_rosa-sts-about-iam-resources[Cluster-specific Operator IAM role reference].
7171

7272
include::modules/rosa-aws-provisioned.adoc[leveloffset=+1]
73-
include::modules/osd-aws-privatelink-firewall-prerequisites.adoc[leveloffset=+1]
73+
// Keeping existing ID to prevent link breakage
74+
[id="osd-aws-privatelink-firewall-prerequisites_rosa-sts-aws-prereqs"]
75+
== AWS firewall prerequisites
76+
77+
If you are using a firewall to control egress traffic from your {product-title}, you must configure your firewall to grant access to the certain domain and port combinations below. {product-title} requires this access to provide a fully managed OpenShift service.
78+
79+
include::modules/osd-aws-privatelink-firewall-prerequisites.adoc[leveloffset=+2]
80+
include::modules/rosa-hcp-firewall-prerequisites.adoc[leveloffset=+2]
7481

7582
[role="_additional-resources"]
7683
.Additional resources

0 commit comments

Comments
 (0)