-
In a firewall environment, ensure that the
access.redhat.comresource is on the allowlist. This resource hosts a signature store that a container client requires for verifying images when pulling them fromregistry.access.redhat.com.
- Documentation
- OpenShift Container Platform
- Installing
- Installation configuration
- Configuring your firewall history bug_report picture_as_pdf
- About
- Release notes
- Getting started
- Architecture
- Architecture overview
- Product architecture
- Installation and update
- Red Hat OpenShift Cluster Manager
- About the multicluster engine for Kubernetes Operator
- Control plane architecture
- NVIDIA GPU architecture overview
- Understanding OpenShift development
- Red Hat Enterprise Linux CoreOS
- Admission plugins
- Installing
- Installation overview
- Selecting an installation method and preparing a cluster
- Cluster capabilities
- Disconnected installation mirroring
- About disconnected installation mirroring
- Creating a mirror registry with mirror registry for Red Hat OpenShift
- Mirroring images for a disconnected installation
- Mirroring images for a disconnected installation using the oc-mirror plugin v1
- Mirroring images for a disconnected installation using oc-mirror plugin v2
- Installing on Alibaba Cloud
- Installing on AWS
- Installation methods
- Configuring an AWS account
- Installer-provisioned infrastructure
- Preparing to install a cluster
- Installing a cluster
- Installing a cluster with customizations
- Installing a cluster with network customizations
- Installing a cluster in a restricted network
- Installing a cluster into an existing VPC
- Installing a private cluster
- Installing a cluster into a government region
- Installing a cluster into a Secret or Top Secret Region
- Installing a cluster into a China region
- Installing a cluster with compute nodes on Local Zones
- Installing a cluster with compute nodes on Wavelength Zones
- Installing a cluster with compute nodes on Outposts
- User-provisioned infrastructure
- Installing a three-node cluster
- Uninstalling a cluster
- Installation configuration parameters
- Installing on Azure
- Preparing to install on Azure
- Configuring an Azure account
- Enabling user-managed encryption on Azure
- Installing a cluster quickly on Azure
- Installing a cluster on Azure with customizations
- Installing a cluster on Azure with network customizations
- Installing a cluster on Azure into an existing VNet
- Installing a private cluster on Azure
- Installing a cluster on Azure into a government region
- Installing a cluster on Azure in a restricted network with user-provisioned infrastructure
- Installing a cluster on Azure using ARM templates
- Installing a cluster on Azure in a restricted network
- Installing a three-node cluster on Azure
- Uninstalling a cluster on Azure
- Installation configuration parameters for Azure
- Installing on Azure Stack Hub
- Preparing to install on Azure Stack Hub
- Configuring an Azure Stack Hub account
- Installing a cluster on Azure Stack Hub with an installer-provisioned infrastructure
- Installing a cluster on Azure Stack Hub with network customizations
- Installing a cluster on Azure Stack Hub using ARM templates
- Installation configuration parameters for Azure Stack Hub
- Uninstalling a cluster on Azure Stack Hub
- Installing on GCP
- Preparing to install on GCP
- Configuring a GCP project
- Installing a cluster quickly on GCP
- Installing a cluster on GCP with customizations
- Installing a cluster on GCP with network customizations
- Installing a cluster on GCP in a restricted network
- Installing a cluster on GCP into an existing VPC
- Installing a cluster on GCP into a shared VPC
- Installing a private cluster on GCP
- Installing a cluster on GCP using Deployment Manager templates
- Installing a cluster into a shared VPC on GCP using Deployment Manager templates
- Installing a cluster on GCP in a restricted network with user-provisioned infrastructure
- Installing a three-node cluster on GCP
- Installation configuration parameters for GCP
- Uninstalling a cluster on GCP
- Installing on IBM Cloud
- Preparing to install on IBM Cloud
- Configuring an IBM Cloud account
- Configuring IAM for IBM Cloud
- User-managed encryption
- Installing a cluster on IBM Cloud with customizations
- Installing a cluster on IBM Cloud with network customizations
- Installing a cluster on IBM Cloud into an existing VPC
- Installing a private cluster on IBM Cloud
- Installing a cluster on IBM Cloud in a restricted network
- Installation configuration parameters for IBM Cloud
- Uninstalling a cluster on IBM Cloud
- Installing on Nutanix
- Installing on-premise with Assisted Installer
- Installing an on-premise cluster with the Agent-based Installer
- Preparing to install with Agent-based Installer
- Understanding disconnected installation mirroring
- Installing a cluster with Agent-based Installer
- Preparing PXE assets for OCP
- Preparing an Agent-based installed cluster for the multicluster engine for Kubernetes
- Installation configuration parameters for the Agent-based Installer
- Installing on a single node
- Installing on bare metal
- Preparing to install on bare metal
- Installing a user-provisioned cluster on bare metal
- Installing a user-provisioned bare metal cluster with network customizations
- Installing a user-provisioned bare metal cluster on a restricted network
- Scaling a user-provisioned installation with the bare metal operator
- Installation configuration parameters for bare metal
- Deploying installer-provisioned clusters on bare metal
- Installing IBM Cloud Bare Metal (Classic)
- Installing on IBM Z and IBM LinuxONE
- Preparing to install on IBM Z and IBM LinuxONE
- Installing a cluster with z/VM on IBM Z and IBM LinuxONE
- Restricted network IBM Z installation with z/VM
- Installing a cluster with RHEL KVM on IBM Z and IBM LinuxONE
- Restricted network IBM Z installation with RHEL KVM
- Installing a cluster in an LPAR on IBM Z and IBM LinuxONE
- Restricted network IBM Z installation in an LPAR
- Installation configuration parameters for IBM Z and IBM LinuxONE
- Installing on IBM Power
- Installing on IBM Power Virtual Server
- Preparing to install on IBM Power Virtual Server
- Configuring an IBM Cloud account
- Creating an IBM Power Virtual Server workspace
- Installing a cluster on IBM Power Virtual Server with customizations
- Installing a cluster on IBM Power Virtual Server into an existing VPC
- Installing a private cluster on IBM Power Virtual Server
- Installing a cluster on IBM Power Virtual Server in a restricted network
- Uninstalling a cluster on IBM Power Virtual Server
- Installation configuration parameters for IBM Power Virtual Server
- Installing on OpenStack
- Preparing to install on OpenStack
- Preparing to install a cluster that uses SR-IOV or OVS-DPDK on OpenStack
- Installing a cluster on OpenStack with customizations
- Installing a cluster on OpenStack on your own infrastructure
- Installing a cluster on OpenStack in a restricted network
- OpenStack Cloud Controller Manager reference guide
- Deploying on OpenStack with rootVolume and etcd on local disk
- Uninstalling a cluster on OpenStack
- Uninstalling a cluster on OpenStack from your own infrastructure
- Installation configuration parameters for OpenStack
- Installing on OCI
- Installing on vSphere
- Installing on any platform
- Installation configuration
- Validating an installation
- Troubleshooting installation issues
- Support for FIPS cryptography
- Postinstallation configuration
- Postinstallation configuration overview
- Configuring a private cluster
- Bare metal configuration
- Configuring multi-architecture compute machines on an OpenShift cluster
- About clusters with multi-architecture compute machines
- Creating a cluster with multi-architecture compute machines on Azure
- Creating a cluster with multi-architecture compute machines on AWS
- Creating a cluster with multi-architecture compute machines on GCP
- Creating a cluster with multi-architecture compute machines on bare metal, IBM Power, or IBM Z
- Creating a cluster with multi-architecture compute machines on IBM Z and IBM LinuxONE with z/VM
- Creating a cluster with multi-architecture compute machines on IBM Z and IBM LinuxONE in an LPAR
- Creating a cluster with multi-architecture compute machines on IBM Z and IBM LinuxONE with RHEL KVM
- Creating a cluster with multi-architecture compute machines on IBM Power
- Managing your cluster with multi-architecture compute machines
- Managing workloads on multi-architecture clusters by using the Multiarch Tuning Operator
- Enabling encryption on a vSphere cluster
- Configuring the vSphere connection settings after an installation
- Cluster tasks
- Node tasks
- Network configuration
- Storage configuration
- Preparing for users
- Changing the cloud provider credentials configuration
- Configuring alert notifications
- Converting a connected cluster to a disconnected cluster
- Enabling cluster capabilities
- Configuring additional devices in an IBM Z or IBM LinuxONE environment
- Regions and zones for a VMware vCenter
- Adding failure domains to an existing Nutanix cluster
- AWS Local Zone or Wavelength Zone tasks
- Extending an AWS VPC cluster into an AWS Outpost
- Updating clusters
- Understanding OpenShift updates
- Preparing to update a cluster
- Performing a cluster update
- Updating a cluster using the CLI
- Updating a cluster using the web console
- Performing an EUS-to-EUS update
- Performing a canary rollout update
- Updating a cluster that includes RHEL compute machines
- Updating a cluster in a disconnected environment
- Updating hardware on nodes running on vSphere
- Migrating to a cluster with multi-architecture compute machines
- Updating hosted control planes
- Updating the boot loader on Red Hat Enterprise Linux CoreOS nodes using bootupd
- Troubleshooting a cluster update
- Support
- Support overview
- Managing your cluster resources
- Getting support
- Remote health monitoring with connected clusters
- About remote health monitoring
- Showing data collected by remote health monitoring
- Opting out of remote health reporting
- Enabling remote health reporting
- Using Insights to identify issues with your cluster
- Using the Insights Operator
- Using remote health reporting in a restricted network
- Importing simple content access entitlements with Insights Operator
- Gathering data about your cluster
- Summarizing cluster specifications
- Troubleshooting
- Troubleshooting installations
- Verifying node health
- Troubleshooting CRI-O container runtime issues
- Troubleshooting operating system issues
- Troubleshooting network issues
- Troubleshooting Operator issues
- Investigating pod issues
- Troubleshooting the Source-to-Image process
- Troubleshooting storage issues
- Investigating monitoring issues
- Diagnosing OpenShift CLI (oc) issues
- Web console
- Web console overview
- Accessing the web console
- Using the OpenShift Container Platform dashboard to get cluster information
- Adding user preferences
- Configuring the web console
- Customizing the web console
- Dynamic plugins
- Web terminal
- Disabling the web console
- Creating quick start tutorials
- Optional capabilities and products
- CLI tools
- Security and compliance
- Security and compliance overview
- Container security
- Understanding container security
- Understanding host and VM security
- Hardening Red Hat Enterprise Linux CoreOS
- Container image signatures
- Understanding compliance
- Securing container content
- Using container registries securely
- Securing the build process
- Deploying containers
- Securing the container platform
- Securing networks
- Securing attached storage
- Monitoring cluster events and logs
- Configuring certificates
- Certificate types and descriptions
- User-provided certificates for the API server
- Proxy certificates
- Service CA certificates
- Node certificates
- Bootstrap certificates
- etcd certificates
- OLM certificates
- Aggregated API client certificates
- Machine Config Operator certificates
- User-provided certificates for default ingress
- Ingress certificates
- Monitoring and cluster logging Operator component certificates
- Control plane certificates
- Compliance Operator
- File Integrity Operator
- Security Profiles Operator
- Security Profiles Operator overview
- Security Profiles Operator release notes
- Understanding the Security Profiles Operator
- Enabling the Security Profiles Operator
- Managing seccomp profiles
- Managing SELinux profiles
- Advanced Security Profiles Operator tasks
- Troubleshooting the Security Profiles Operator
- Uninstalling the Security Profiles Operator
- NBDE Tang Server Operator
- NBDE Tang Server Operator overview
- NBDE Tang Server Operator release notes
- Understanding the NBDE Tang Server Operator
- Installing the NBDE Tang Server Operator
- Configuring and managing Tang servers using the NBDE Tang Server Operator
- Identifying URL of a Tang server deployed with the NBDE Tang Server Operator
- cert-manager Operator for Red Hat OpenShift
- cert-manager Operator for Red Hat OpenShift overview
- cert-manager Operator for Red Hat OpenShift release notes
- Installing the cert-manager Operator for Red Hat OpenShift
- Configuring the egress proxy
- Customizing cert-manager by using the cert-manager Operator API fields
- Authenticating the cert-manager Operator for Red Hat OpenShift
- Configuring an ACME issuer
- Configuring certificates with an issuer
- Monitoring the cert-manager Operator for Red Hat OpenShift
- Configuring log levels for cert-manager and the cert-manager Operator for Red Hat OpenShift
- Uninstalling the cert-manager Operator for Red Hat OpenShift
- Viewing audit logs
- Configuring the audit log policy
- Configuring TLS security profiles
- Configuring seccomp profiles
- Allowing JavaScript-based access to the API server from additional hosts
- Encrypting etcd data
- Scanning pods for vulnerabilities
- Network-Bound Disk Encryption (NBDE)
- Authentication and authorization
- Authentication and authorization overview
- Understanding authentication
- Configuring the internal OAuth server
- Configuring OAuth clients
- Managing user-owned OAuth access tokens
- Understanding identity provider configuration
- Configuring identity providers
- Configuring an htpasswd identity provider
- Configuring a Keystone identity provider
- Configuring an LDAP identity provider
- Configuring a basic authentication identity provider
- Configuring a request header identity provider
- Configuring a GitHub or GitHub Enterprise identity provider
- Configuring a GitLab identity provider
- Configuring a Google identity provider
- Configuring an OpenID Connect identity provider
- Using RBAC to define and apply permissions
- Removing the kubeadmin user
- Understanding and creating service accounts
- Using service accounts in applications
- Using a service account as an OAuth client
- Scoping tokens
- Using bound service account tokens
- Managing security context constraints
- Understanding and managing pod security admission
- Impersonating the system:admin user
- Syncing LDAP groups
- Managing cloud provider credentials
- Networking
- About networking
- Understanding networking
- Zero trust networking
- Accessing hosts
- Networking dashboards
- Network security
- Understanding the Cluster Network Operator
- Understanding the DNS Operator
- Understanding the Ingress Operator
- Ingress sharding
- Configuring the Ingress Controller for manual DNS management
- Configuring the Ingress Controller endpoint publishing strategy
- Verifying connectivity to an endpoint
- Changing the cluster network MTU
- Configuring the node port service range
- Configuring the cluster network IP address range
- Configuring IP failover
- Configuring system controls and interface attributes using the tuning plugin
- Using SCTP
- Using PTP hardware
- External DNS Operator
- External DNS Operator release notes
- Understanding the External DNS Operator
- Installing the External DNS Operator
- External DNS Operator configuration parameters
- Creating DNS records on a public hosted zone for AWS
- Creating DNS records on a public zone for Azure
- Creating DNS records on a public managed zone for GCP
- Creating DNS records on a public DNS zone for Infoblox
- Configuring the cluster-wide proxy on the External DNS Operator
- CIDR range definitions
- AWS Load Balancer Operator
- AWS Load Balancer Operator release notes
- Understanding the AWS Load Balancer Operator
- Installing the AWS Load Balancer Operator
- Preparing for the AWS Load Balancer Operator on a cluster using the AWS Security Token Service (STS)
- Creating an instance of the AWS Load Balancer Controller
- Serving multiple ingress resources through a single AWS Load Balancer
- Adding TLS termination on the AWS Load Balancer
- Configuring cluster-wide proxy on the AWS Load Balancer Operator
- Multiple networks
- Understanding multiple networks
- Configuring an additional network
- About virtual routing and forwarding
- Configuring multi-network policy
- Attaching a pod to an additional network
- Removing a pod from an additional network
- Editing an additional network
- Removing an additional network
- Assigning a secondary network to a VRF
- Hardware networks
- About Single Root I/O Virtualization (SR-IOV) hardware networks
- Installing the SR-IOV Operator
- Configuring the SR-IOV Operator
- Configuring an SR-IOV network device
- Configuring an SR-IOV Ethernet network attachment
- Configuring an SR-IOV InfiniBand network attachment
- Adding a pod to an SR-IOV network
- Configuring interface-level network sysctl settings and all-multicast mode for SR-IOV networks
- Configuring QinQ support for SR-IOV networks
- Using high performance multicast
- Using DPDK and RDMA
- Using pod-level bonding for secondary networks
- Configuring hardware offloading
- Switching Bluefield-2 from NIC to DPU mode
- Uninstalling the SR-IOV Operator
- OVN-Kubernetes network plugin
- About the OVN-Kubernetes network plugin
- OVN-Kubernetes architecture
- OVN-Kubernetes troubleshooting
- OVN-Kubernetes traffic tracing
- Migrating from the OpenShift SDN network plugin
- Rolling back to the OpenShift SDN network plugin
- Converting to IPv4/IPv6 dual stack networking
- Configuring internal subnets
- Configure an external gateway on the default network
- Configuring an egress IP address
- Assigning an egress IP address
- Configuring an egress service
- Considerations for the use of an egress router pod
- Deploying an egress router pod in redirect mode
- Enabling multicast for a project
- Disabling multicast for a project
- Tracking network flows
- Configuring hybrid networking
- OpenShift SDN network plugin
- About the OpenShift SDN network plugin
- Configuring egress IPs for a project
- Configuring an egress firewall for a project
- Viewing an egress firewall for a project
- Editing an egress firewall for a project
- Removing an egress firewall from a project
- Considerations for the use of an egress router pod
- Deploying an egress router pod in redirect mode
- Deploying an egress router pod in HTTP proxy mode
- Deploying an egress router pod in DNS proxy mode
- Configuring an egress router pod destination list from a config map
- Enabling multicast for a project
- Disabling multicast for a project
- Configuring multitenant isolation
- Configuring kube-proxy
- Configuring Routes
- Configuring ingress cluster traffic
- Overview
- Configuring ExternalIPs for services
- Configuring ingress cluster traffic using an Ingress Controller
- Configuring ingress cluster traffic using a load balancer
- Configuring ingress cluster traffic on AWS
- Configuring ingress cluster traffic using a service external IP
- Configuring ingress cluster traffic using a NodePort
- Configuring ingress cluster traffic using load balancer allowed source ranges
- Kubernetes NMState
- Configuring the cluster-wide proxy
- Configuring a custom PKI
- Load balancing on OpenStack
- Load balancing with MetalLB
- About MetalLB and the MetalLB Operator
- Installing the MetalLB Operator
- Upgrading the MetalLB Operator
- Configuring MetalLB address pools
- Advertising the IP address pools
- Configuring MetalLB BGP peers
- Advertising an IP address pool using the community alias
- Configuring MetalLB BFD profiles
- Configuring services to use MetalLB
- Managing symmetric routing with MetalLB
- Configuring the integration of MetalLB and FRR-K8s
- MetalLB logging, troubleshooting, and support
- Associating secondary interfaces metrics to network attachments
- Storage
- Storage overview
- Understanding ephemeral storage
- Understanding persistent storage
- Configuring persistent storage
- Persistent storage using AWS Elastic Block Store
- Persistent storage using Azure Disk
- Persistent storage using Azure File
- Persistent storage using Cinder
- Persistent storage using Fibre Channel
- Persistent storage using FlexVolume
- Persistent storage using GCE Persistent Disk
- Persistent Storage using iSCSI
- Persistent storage using NFS
- Persistent storage using Red Hat OpenShift Data Foundation
- Persistent storage using VMware vSphere
- Persistent storage using local storage
- Using Container Storage Interface (CSI)
- Configuring CSI volumes
- CSI inline ephemeral volumes
- Shared Resource CSI Driver Operator
- CSI volume snapshots
- CSI volume cloning
- Managing the default storage class
- CSI automatic migration
- Detach CSI volumes after non-graceful node shutdown
- AWS Elastic Block Store CSI Driver Operator
- AWS Elastic File Service CSI Driver Operator
- Azure Disk CSI Driver Operator
- Azure File CSI Driver Operator
- Azure Stack Hub CSI Driver Operator
- GCP PD CSI Driver Operator
- GCP Filestore CSI Driver Operator
- IBM VPC Block CSI Driver Operator
- IBM Power Virtual Server Block CSI Driver Operator
- OpenStack Cinder CSI Driver Operator
- OpenStack Manila CSI Driver Operator
- Secrets Store CSI Driver Operator
- CIFS/SMB CSI Driver Operator
- VMware vSphere CSI Driver Operator
- Generic ephemeral volumes
- Expanding persistent volumes
- Dynamic provisioning
- Registry
- Registry overview
- Image Registry Operator in OpenShift Container Platform
- Setting up and configuring the registry
- Configuring the registry for AWS user-provisioned infrastructure
- Configuring the registry for GCP user-provisioned infrastructure
- Configuring the registry for OpenStack user-provisioned infrastructure
- Configuring the registry for Azure user-provisioned infrastructure
- Configuring the registry for OpenStack
- Configuring the registry for bare metal
- Configuring the registry for vSphere
- Configuring the registry for OpenShift Data Foundation
- Configuring the registry for Nutanix
- Accessing the registry
- Exposing the registry
- Operators
- Operators overview
- Understanding Operators
- User tasks
- Administrator tasks
- Adding Operators to a cluster
- Updating installed Operators
- Deleting Operators from a cluster
- Configuring OLM features
- Configuring proxy support
- Viewing Operator status
- Managing Operator conditions
- Allowing non-cluster administrators to install Operators
- Managing custom catalogs
- Using OLM on restricted networks
- Catalog source pod scheduling
- Troubleshooting Operator issues
- Developing Operators
- About the Operator SDK
- Installing the Operator SDK CLI
- Go-based Operators
- Ansible-based Operators
- Helm-based Operators
- Java-based Operators
- Defining cluster service versions (CSVs)
- Working with bundle images
- Complying with pod security admission
- Token authentication
- Validating Operators using the scorecard
- Validating Operator bundles
- High-availability or single-node cluster detection and support
- Configuring built-in monitoring with Prometheus
- Configuring leader election
- Configuring support for multiple platforms
- Object pruning utility
- Migrating package manifest projects to bundle format
- Operator SDK CLI reference
- Cluster Operators reference
- OLM 1.0 (Technology Preview)
- CI/CD
- CI/CD overview
- Builds using Shipwright
- Builds using BuildConfig
- Understanding image builds
- Understanding build configurations
- Creating build inputs
- Managing build output
- Using build strategies
- Custom image builds with Buildah
- Performing and configuring basic builds
- Triggering and modifying builds
- Performing advanced builds
- Using Red Hat subscriptions in builds
- Securing builds by strategy
- Build configuration resources
- Troubleshooting builds
- Setting up additional trusted certificate authorities for builds
- Pipelines
- GitOps
- Jenkins
- Images
- Overview of images
- Configuring the Cluster Samples Operator
- Using the Cluster Samples Operator with an alternate registry
- Creating images
- Managing images
- Managing image streams
- Using image streams with Kubernetes resources
- Triggering updates on image stream changes
- Image configuration resources
- Using templates
- Using Ruby on Rails
- Using images
- Building applications
- Building applications overview
- Projects
- Creating applications
- Viewing application composition by using the Topology view
- Exporting applications
- Working with Helm charts
- Deployments
- Quotas
- Using config maps with applications
- Monitoring project and application metrics using the Developer perspective
- Monitoring application health
- Editing applications
- Pruning objects to reclaim resources
- Idling applications
- Deleting applications
- Using the Red Hat Marketplace
- Serverless
- Machine configuration
- Machine configuration overview
- Using machine config objects to configure nodes
- Using node disruption policies to minimize disruption from machine config changes
- Configuring MCO-related custom resources
- Updated boot images
- Managing unused rendered machine configs
- Red Hat Enterprise Linux (RHEL) CoreOS image layering
- Machine Config Daemon metrics
- Machine management
- Overview of machine management
- Managing compute machines with the Machine API
- Creating a compute machine set on Alibaba Cloud
- Creating a compute machine set on AWS
- Creating a compute machine set on Azure
- Creating a compute machine set on Azure Stack Hub
- Creating a compute machine set on GCP
- Creating a compute machine set on IBM Cloud
- Creating a compute machine set on IBM Power Virtual Server
- Creating a compute machine set on Nutanix
- Creating a compute machine set on OpenStack
- Creating a compute machine set on vSphere
- Creating a compute machine set on bare metal
- Manually scaling a compute machine set
- Modifying a compute machine set
- Machine phases and lifecycle
- Deleting a machine
- Applying autoscaling to a cluster
- Creating infrastructure machine sets
- Adding a RHEL compute machine
- Adding more RHEL compute machines
- Managing user-provisioned infrastructure manually
- Managing control plane machines
- About control plane machine sets
- Getting started with control plane machine sets
- Managing control plane machines with control plane machine sets
- Control plane machine set configuration
- Configuration options for control plane machines
- Control plane configuration options for Amazon Web Services
- Control plane configuration options for Microsoft Azure
- Control plane configuration options for Google Cloud Platform
- Control plane configuration options for Nutanix
- Control plane configuration options for Red Hat OpenStack Platform
- Control plane configuration options for VMware vSphere
- Control plane resiliency and recovery
- Troubleshooting the control plane machine set
- Disabling the control plane machine set
- Managing machines with the Cluster API
- Deploying machine health checks
- Hosted control planes
- Hosted control planes overview
- Getting started with hosted control planes
- Authentication and authorization for hosted control planes
- Handling a machine configuration for hosted control planes
- Using feature gates in a hosted cluster
- Updating hosted control planes
- Hosted control planes Observability
- High availability for hosted control planes
- Troubleshooting hosted control planes
- Nodes
- Overview of nodes
- Working with pods
- About pods
- Viewing pods
- Configuring a cluster for pods
- Automatically scaling pods with the horizontal pod autoscaler
- Automatically adjust pod resource levels with the vertical pod autoscaler
- Providing sensitive data to pods by using secrets
- Providing sensitive data to pods by using an external secrets store
- Creating and using config maps
- Using Device Manager to make devices available to nodes
- Including pod priority in pod scheduling decisions
- Placing pods on specific nodes using node selectors
- Run Once Duration Override Operator
- Automatically scaling pods with the Custom Metrics Autoscaler Operator
- Release notes
- Custom Metrics Autoscaler Operator overview
- Installing the custom metrics autoscaler
- Understanding the custom metrics autoscaler triggers
- Understanding custom metrics autoscaler trigger authentications
- Pausing the custom metrics autoscaler
- Gathering audit logs
- Gathering debugging data
- Viewing Operator metrics
- Understanding how to add custom metrics autoscalers
- Removing the Custom Metrics Autoscaler Operator
- Controlling pod placement onto nodes (scheduling)
- About pod placement using the scheduler
- Scheduling pods using a scheduler profile
- Placing pods relative to other pods using pod affinity and anti-affinity rules
- Controlling pod placement on nodes using node affinity rules
- Placing pods onto overcommited nodes
- Controlling pod placement using node taints
- Placing pods on specific nodes using node selectors
- Controlling pod placement using pod topology spread constraints
- Descheduler
- Secondary scheduler
- Using Jobs and DaemonSets
- Working with nodes
- Viewing and listing the nodes in your cluster
- Working with nodes
- Managing nodes
- Managing the maximum number of pods per node
- Using the Node Tuning Operator
- Remediating, fencing, and maintaining nodes
- Understanding node rebooting
- Freeing node resources using garbage collection
- Allocating resources for nodes
- Allocating specific CPUs for nodes in a cluster
- Enabling TLS security profiles for the kubelet
- Creating infrastructure nodes
- Working with containers
- Understanding containers
- Using Init Containers to perform tasks before a pod is deployed
- Using volumes to persist container data
- Mapping volumes using projected volumes
- Allowing containers to consume API objects
- Copying files to or from a container
- Executing remote commands in a container
- Using port forwarding to access applications in a container
- Using sysctls in containers
- Accessing faster builds with /dev/fuse
- Working with clusters
- Viewing system event information in a cluster
- Analyzing cluster resource levels
- Setting limit ranges
- Configuring cluster memory to meet container memory and risk requirements
- Configuring your cluster to place pods on overcommited nodes
- Configuring the Linux cgroup version on your nodes
- Enabling features using FeatureGates
- Improving cluster stability in high latency environments using worker latency profiles
- Remote worker nodes on the network edge
- Worker nodes for single-node OpenShift clusters
- Node metrics dashboard
- OpenShift sandboxed containers
- Observability
- Observability overview
- Monitoring
- Monitoring overview
- Configuring the monitoring stack
- Enabling monitoring for user-defined projects
- Enabling alert routing for user-defined projects
- Managing metrics
- Managing alerts
- Reviewing monitoring dashboards
- Accessing monitoring APIs by using the CLI
- Troubleshooting monitoring issues
- Config map reference for the Cluster Monitoring Operator
- Logging
- Release notes
- Support
- Troubleshooting logging
- About Logging
- Installing Logging
- Updating Logging
- Visualizing logs
- Configuring your Logging deployment
- Log collection and forwarding
- Log storage
- Logging alerts
- Performance and reliability tuning
- Scheduling resources
- Uninstalling Logging
- Exported fields
- API reference
- Glossary
- Distributed tracing
- Red Hat build of OpenTelemetry
- Release notes
- Installing
- Configuring the Collector
- Configuring the instrumentation
- Sending traces and metrics to the Collector
- Configuring metrics for the monitoring stack
- Forwarding traces to a TempoStack
- Configuring the Collector metrics
- Gathering the observability data from multiple clusters
- Troubleshooting
- Migrating
- Upgrading
- Removing
- Network Observability
- Network Observability release notes
- Network Observability overview
- Installing the Network Observability Operator
- Understanding Network Observability Operator
- Configuring the Network Observability Operator
- Network Policy
- Observing the network traffic
- Using metrics with dashboards and alerts
- Monitoring the Network Observability Operator
- Scheduling resources
- Network Observability CLI
- FlowCollector API reference
- FlowMetric API reference
- Flows format reference
- Troubleshooting Network Observability
- Power Monitoring
- Cluster Observability Operator
- Scalability and performance
- Recommended performance and scalability practices
- Planning your environment according to object maximums
- Recommended host practices for IBM Z & IBM LinuxONE environments
- Using the Node Tuning Operator
- Using CPU Manager and Topology Manager
- Scheduling NUMA-aware workloads
- Scalability and performance optimization
- Managing bare metal hosts
- Monitoring bare-metal events
- What huge pages do and how they are consumed by apps
- Low latency tuning
- Improving cluster stability in high latency environments using worker latency profiles
- Workload partitioning
- Using the Node Observability Operator
- Edge computing
- Challenges of the network far edge
- Preparing the hub cluster for ZTP
- Updating GitOps ZTP
- Installing managed clusters with RHACM and SiteConfig resources
- Manually installing a single-node OpenShift cluster with GitOps ZTP
- Recommended single-node OpenShift cluster configuration for vDU application workloads
- Validating cluster tuning for vDU application workloads
- Advanced managed cluster configuration with SiteConfig resources
- Managing cluster polices with PolicyGenerator resources
- Managing cluster polices with PolicyGenTemplate resources
- Using hub templates in PolicyGenerator or PolicyGenTemplate CRs
- Updating managed clusters with the Topology Aware Lifecycle Manager
- Expanding single-node OpenShift clusters with GitOps ZTP
- Pre-caching images for single-node OpenShift deployments
- Image-based upgrade for single-node OpenShift clusters
- Understanding the image-based upgrade for single-node OpenShift clusters
- Preparing for an image-based upgrade for single-node OpenShift clusters
- Configuring a shared container directory for the image-based upgrade
- Installing Operators for the image-based upgrade
- Generating a seed image for the image-based upgrade with Lifecycle Agent
- Creating ConfigMap objects for the image-based upgrade with Lifecycle Agent
- Creating ConfigMap objects for the image-based upgrade with Lifecycle Agent using GitOps ZTP
- Performing an image-based upgrade for single-node OpenShift clusters
- Performing an image-based upgrade for single-node OpenShift clusters using GitOps ZTP
- Specialized hardware and driver enablement
- Backup and restore
- Overview of backup and restore operations
- Shutting down a cluster gracefully
- Restarting a cluster gracefully
- OADP Application backup and restore
- Introduction to OpenShift API for Data Protection
- OADP release notes
- OADP features and plugins
- Installing and configuring OADP
- Uninstalling OADP
- OADP backing up
- OADP restoring
- OADP and ROSA
- OADP and AWS STS
- OADP 1.2 Data Mover
- OADP 1.3 Data Mover
- Troubleshooting
- OADP API
- Advanced OADP features and functionalities
- Control plane backup and restore
- Migrating from version 3 to 4
- Migrating from version 3 to 4 overview
- About migrating from OpenShift Container Platform 3 to 4
- Differences between OpenShift Container Platform 3 and 4
- Network considerations
- About MTC
- Installing MTC
- Installing MTC in a restricted network environment
- Upgrading MTC
- Premigration checklists
- Migrating your applications
- Advanced migration options
- Troubleshooting
- Migration Toolkit for Containers
- API reference
- Understanding API tiers
- API compatibility guidelines
- Editing kubelet log level verbosity and gathering logs
- API list
- Common object reference
- Authorization APIs
- About Authorization APIs
- LocalResourceAccessReview [authorization.openshift.io/v1]
- LocalSubjectAccessReview [authorization.openshift.io/v1]
- ResourceAccessReview [authorization.openshift.io/v1]
- SelfSubjectRulesReview [authorization.openshift.io/v1]
- SubjectAccessReview [authorization.openshift.io/v1]
- SubjectRulesReview [authorization.openshift.io/v1]
- SelfSubjectReview [authentication.k8s.io/v1]
- TokenRequest [authentication.k8s.io/v1]
- TokenReview [authentication.k8s.io/v1]
- LocalSubjectAccessReview [authorization.k8s.io/v1]
- SelfSubjectAccessReview [authorization.k8s.io/v1]
- SelfSubjectRulesReview [authorization.k8s.io/v1]
- SubjectAccessReview [authorization.k8s.io/v1]
- Autoscale APIs
- Config APIs
- About Config APIs
- APIServer [config.openshift.io/v1]
- Authentication [config.openshift.io/v1]
- Build [config.openshift.io/v1]
- ClusterOperator [config.openshift.io/v1]
- ClusterVersion [config.openshift.io/v1]
- Console [config.openshift.io/v1]
- DNS [config.openshift.io/v1]
- FeatureGate [config.openshift.io/v1]
- HelmChartRepository [helm.openshift.io/v1beta1]
- Image [config.openshift.io/v1]
- ImageDigestMirrorSet [config.openshift.io/v1]
- ImageContentPolicy [config.openshift.io/v1]
- ImageTagMirrorSet [config.openshift.io/v1]
- Infrastructure [config.openshift.io/v1]
- Ingress [config.openshift.io/v1]
- Network [config.openshift.io/v1]
- Node [config.openshift.io/v1]
- OAuth [config.openshift.io/v1]
- OperatorHub [config.openshift.io/v1]
- Project [config.openshift.io/v1]
- ProjectHelmChartRepository [helm.openshift.io/v1beta1]
- Proxy [config.openshift.io/v1]
- Scheduler [config.openshift.io/v1]
- Console APIs
- About Console APIs
- ConsoleCLIDownload [console.openshift.io/v1]
- ConsoleExternalLogLink [console.openshift.io/v1]
- ConsoleLink [console.openshift.io/v1]
- ConsoleNotification [console.openshift.io/v1]
- ConsolePlugin [console.openshift.io/v1]
- ConsoleQuickStart [console.openshift.io/v1]
- ConsoleSample [console.openshift.io/v1]
- ConsoleYAMLSample [console.openshift.io/v1]
- Extension APIs
- Image APIs
- About Image APIs
- Image [image.openshift.io/v1]
- ImageSignature [image.openshift.io/v1]
- ImageStreamImage [image.openshift.io/v1]
- ImageStreamImport [image.openshift.io/v1]
- ImageStreamLayers [image.openshift.io/v1]
- ImageStreamMapping [image.openshift.io/v1]
- ImageStream [image.openshift.io/v1]
- ImageStreamTag [image.openshift.io/v1]
- ImageTag [image.openshift.io/v1]
- SecretList [image.openshift.io/v1]
- Machine APIs
- About Machine APIs
- ContainerRuntimeConfig [machineconfiguration.openshift.io/v1]
- ControllerConfig [machineconfiguration.openshift.io/v1]
- ControlPlaneMachineSet [machine.openshift.io/v1]
- KubeletConfig [machineconfiguration.openshift.io/v1]
- MachineConfig [machineconfiguration.openshift.io/v1]
- MachineConfigPool [machineconfiguration.openshift.io/v1]
- MachineHealthCheck [machine.openshift.io/v1beta1]
- Machine [machine.openshift.io/v1beta1]
- MachineSet [machine.openshift.io/v1beta1]
- Metadata APIs
- Monitoring APIs
- About Monitoring APIs
- Alertmanager [monitoring.coreos.com/v1]
- AlertmanagerConfig [monitoring.coreos.com/v1beta1]
- AlertRelabelConfig [monitoring.openshift.io/v1]
- AlertingRule [monitoring.openshift.io/v1]
- PodMonitor [monitoring.coreos.com/v1]
- Probe [monitoring.coreos.com/v1]
- Prometheus [monitoring.coreos.com/v1]
- PrometheusRule [monitoring.coreos.com/v1]
- ServiceMonitor [monitoring.coreos.com/v1]
- ThanosRuler [monitoring.coreos.com/v1]
- Network APIs
- About Network APIs
- AdminNetworkPolicy [policy.networking.k8s.io/v1alpha1]
- AdminPolicyBasedExternalRoute [k8s.ovn.org/v1]
- BaselineAdminNetworkPolicy [policy.networking.k8s.io/v1alpha1]
- CloudPrivateIPConfig [cloud.network.openshift.io/v1]
- EgressFirewall [k8s.ovn.org/v1]
- EgressIP [k8s.ovn.org/v1]
- EgressQoS [k8s.ovn.org/v1]
- EgressService [k8s.ovn.org/v1]
- Endpoints [undefined/v1]
- EndpointSlice [discovery.k8s.io/v1]
- EgressRouter [network.operator.openshift.io/v1]
- Ingress [networking.k8s.io/v1]
- IngressClass [networking.k8s.io/v1]
- IPAddress [ipam.cluster.x-k8s.io/v1beta1]
- IPAddressClaim [ipam.cluster.x-k8s.io/v1beta1]
- IPPool [whereabouts.cni.cncf.io/v1alpha1]
- NetworkAttachmentDefinition [k8s.cni.cncf.io/v1]
- NetworkPolicy [networking.k8s.io/v1]
- OverlappingRangeIPReservation [whereabouts.cni.cncf.io/v1alpha1]
- PodNetworkConnectivityCheck [controlplane.operator.openshift.io/v1alpha1]
- Route [route.openshift.io/v1]
- Service [undefined/v1]
- Node APIs
- OAuth APIs
- Operator APIs
- About Operator APIs
- Authentication [operator.openshift.io/v1]
- CloudCredential [operator.openshift.io/v1]
- ClusterCSIDriver [operator.openshift.io/v1]
- Console [operator.openshift.io/v1]
- Config [operator.openshift.io/v1]
- Config [imageregistry.operator.openshift.io/v1]
- Config [samples.operator.openshift.io/v1]
- CSISnapshotController [operator.openshift.io/v1]
- DNS [operator.openshift.io/v1]
- DNSRecord [ingress.operator.openshift.io/v1]
- Etcd [operator.openshift.io/v1]
- ImageContentSourcePolicy [operator.openshift.io/v1alpha1]
- ImagePruner [imageregistry.operator.openshift.io/v1]
- IngressController [operator.openshift.io/v1]
- InsightsOperator [operator.openshift.io/v1]
- KubeAPIServer [operator.openshift.io/v1]
- KubeControllerManager [operator.openshift.io/v1]
- KubeScheduler [operator.openshift.io/v1]
- KubeStorageVersionMigrator [operator.openshift.io/v1]
- MachineConfiguration [operator.openshift.io/v1]
- Network [operator.openshift.io/v1]
- OpenShiftAPIServer [operator.openshift.io/v1]
- OpenShiftControllerManager [operator.openshift.io/v1]
- OperatorPKI [network.operator.openshift.io/v1]
- ServiceCA [operator.openshift.io/v1]
- Storage [operator.openshift.io/v1]
- OperatorHub APIs
- About OperatorHub APIs
- CatalogSource [operators.coreos.com/v1alpha1]
- ClusterServiceVersion [operators.coreos.com/v1alpha1]
- InstallPlan [operators.coreos.com/v1alpha1]
- OLMConfig [operators.coreos.com/v1]
- Operator [operators.coreos.com/v1]
- OperatorCondition [operators.coreos.com/v2]
- OperatorGroup [operators.coreos.com/v1]
- PackageManifest [packages.operators.coreos.com/v1]
- Subscription [operators.coreos.com/v1alpha1]
- Policy APIs
- Project APIs
- Provisioning APIs
- About Provisioning APIs
- BMCEventSubscription [metal3.io/v1alpha1]
- BareMetalHost [metal3.io/v1alpha1]
- DataImage [metal3.io/v1alpha1]
- FirmwareSchema [metal3.io/v1alpha1]
- HardwareData [metal3.io/v1alpha1]
- HostFirmwareComponents [metal3.io/v1alpha1]
- HostFirmwareSettings [metal3.io/v1alpha1]
- Metal3Remediation [infrastructure.cluster.x-k8s.io/v1beta1]
- Metal3RemediationTemplate [infrastructure.cluster.x-k8s.io/v1beta1]
- PreprovisioningImage [metal3.io/v1alpha1]
- Provisioning [metal3.io/v1alpha1]
- RBAC APIs
- Role APIs
- Schedule and quota APIs
- About Schedule and quota APIs
- AppliedClusterResourceQuota [quota.openshift.io/v1]
- ClusterResourceQuota [quota.openshift.io/v1]
- FlowSchema [flowcontrol.apiserver.k8s.io/v1]
- LimitRange [undefined/v1]
- PriorityClass [scheduling.k8s.io/v1]
- PriorityLevelConfiguration [flowcontrol.apiserver.k8s.io/v1]
- ResourceQuota [undefined/v1]
- Security APIs
- About Security APIs
- CertificateSigningRequest [certificates.k8s.io/v1]
- CredentialsRequest [cloudcredential.openshift.io/v1]
- PodSecurityPolicyReview [security.openshift.io/v1]
- PodSecurityPolicySelfSubjectReview [security.openshift.io/v1]
- PodSecurityPolicySubjectReview [security.openshift.io/v1]
- RangeAllocation [security.openshift.io/v1]
- Secret [undefined/v1]
- SecurityContextConstraints [security.openshift.io/v1]
- ServiceAccount [undefined/v1]
- Storage APIs
- About Storage APIs
- CSIDriver [storage.k8s.io/v1]
- CSINode [storage.k8s.io/v1]
- CSIStorageCapacity [storage.k8s.io/v1]
- PersistentVolume [undefined/v1]
- PersistentVolumeClaim [undefined/v1]
- StorageClass [storage.k8s.io/v1]
- StorageState [migration.k8s.io/v1alpha1]
- StorageVersionMigration [migration.k8s.io/v1alpha1]
- VolumeAttachment [storage.k8s.io/v1]
- VolumeSnapshot [snapshot.storage.k8s.io/v1]
- VolumeSnapshotClass [snapshot.storage.k8s.io/v1]
- VolumeSnapshotContent [snapshot.storage.k8s.io/v1]
- Template APIs
- User and group APIs
- Workloads APIs
- About Workloads APIs
- BuildConfig [build.openshift.io/v1]
- Build [build.openshift.io/v1]
- BuildLog [build.openshift.io/v1]
- BuildRequest [build.openshift.io/v1]
- CronJob [batch/v1]
- DaemonSet [apps/v1]
- Deployment [apps/v1]
- DeploymentConfig [apps.openshift.io/v1]
- DeploymentConfigRollback [apps.openshift.io/v1]
- DeploymentLog [apps.openshift.io/v1]
- DeploymentRequest [apps.openshift.io/v1]
- Job [batch/v1]
- Pod [undefined/v1]
- ReplicationController [undefined/v1]
- ReplicaSet [apps/v1]
- StatefulSet [apps/v1]
- Service Mesh
- Service Mesh 2.x
- About OpenShift Service Mesh
- Service Mesh 2.x release notes
- Upgrading Service Mesh
- Understanding Service Mesh
- Service Mesh deployment models
- Service Mesh and Istio differences
- Preparing to install Service Mesh
- Installing the Operators
- Creating the ServiceMeshControlPlane
- Adding services to a service mesh
- Enabling sidecar injection
- Managing users and profiles
- Security
- Traffic management
- Metrics, logs, and traces
- Performance and scalability
- Deploying to production
- Federation
- Extensions
- OpenShift Service Mesh Console plugin
- 3scale WebAssembly for 2.1
- 3scale Istio adapter for 2.0
- Troubleshooting Service Mesh
- Control plane configuration reference
- Kiali configuration reference
- Jaeger configuration reference
- Uninstalling Service Mesh
- Service Mesh 1.x
- Service Mesh 1.x release notes
- Service Mesh architecture
- Service Mesh and Istio differences
- Preparing to install Service Mesh
- Installing Service Mesh
- Security
- Traffic management
- Deploying applications on Service Mesh
- Data visualization and observability
- Custom resources
- 3scale Istio adapter for 1.x
- Removing Service Mesh
- Service Mesh 2.x
- Virtualization
- About
- Release notes
- Getting started
- Installing
- Postinstallation configuration
- Updating
- Virtual machines
- Creating VMs from Red Hat images
- Creating VMs from custom images
- Connecting to VM consoles
- Configuring SSH access to VMs
- Editing virtual machines
- Editing boot order
- Deleting virtual machines
- Exporting virtual machines
- Managing virtual machine instances
- Controlling virtual machine states
- Using virtual Trusted Platform Module devices
- Managing virtual machines with OpenShift Pipelines
- Advanced virtual machine management
- Working with resource quotas for virtual machines
- Specifying nodes for virtual machines
- Activating kernel samepage merging (KSM)
- Configuring certificate rotation
- Configuring the default CPU model
- UEFI mode for virtual machines
- Configuring PXE booting for virtual machines
- Using huge pages with virtual machines
- Enabling dedicated resources for a virtual machine
- Scheduling virtual machines
- Configuring PCI passthrough
- Configuring virtual GPUs
- Enabling descheduler evictions on virtual machines
- About high availability for virtual machines
- Control plane tuning
- Assigning compute resources
- Running real-time workloads
- About multi-queue functionality
- VM disks
- Networking
- Networking configuration overview
- Connecting a VM to the default pod network
- Exposing a VM by using a service
- Accessing a VM by using its internal FQDN
- Connecting a VM to a Linux bridge network
- Connecting a VM to an SR-IOV network
- Using DPDK with SR-IOV
- Connecting a VM to an OVN-Kubernetes secondary network
- Hot plugging secondary network interfaces
- Connecting a VM to a service mesh
- Configuring a dedicated network for live migration
- Configuring and viewing IP addresses
- Accessing a VM by using its external FQDN
- Managing MAC address pools for network interfaces
- Storage
- Storage configuration overview
- Configuring storage profiles
- Managing automatic boot source updates
- Reserving PVC space for file system overhead
- Configuring local storage by using HPP
- Enabling user permissions to clone data volumes across namespaces
- Configuring CDI to override CPU and memory quotas
- Preparing CDI scratch space
- Using preallocation for data volumes
- Managing data volume annotations
- Live migration
- Nodes
- Monitoring
- Support
- Backup and restore
×
Configuring your firewall
If you use a firewall, you must configure it so that OpenShift Container Platform can access the sites that it requires to function. You must always grant access to some sites, and you grant access to more if you use Red Hat Insights, the Telemetry service, a cloud to host your cluster, and certain build strategies.
Configuring your firewall for OpenShift Container Platform
Before you install OpenShift Container Platform, you must configure your firewall to grant access to the sites that OpenShift Container Platform requires. When using a firewall, make additional configurations to the firewall so that OpenShift Container Platform can access the sites that it requires to function.
There are no special configuration considerations for services running on only controller nodes compared to worker nodes.
|
If your environment has a dedicated load balancer in front of your OpenShift Container Platform cluster, review the allowlists between your firewall and load balancer to prevent unwanted network restrictions to your cluster. |
Procedure
-
Set the following registry URLs for your firewall’s allowlist:
URL Port Function registry.redhat.io443
Provides core container images
access.redhat.com[1]443
Hosts all the container images that are stored on the Red Hat Ecosytem Catalog, including core container images.
quay.io443
Provides core container images
cdn.quay.io443
Provides core container images
cdn01.quay.io443
Provides core container images
cdn02.quay.io443
Provides core container images
cdn03.quay.io443
Provides core container images
cdn04.quay.io443
Provides core container images
cdn05.quay.io443
Provides core container images
cdn06.quay.io443
Provides core container images
sso.redhat.com443
The
https://console.redhat.comsite uses authentication fromsso.redhat.comYou can use the wildcards
*.quay.ioand*.openshiftapps.cominstead ofcdn.quay.ioandcdn0[1-3].quay.ioin your allowlist. When you add a site, such asquay.io, to your allowlist, do not add a wildcard entry, such as*.quay.io, to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, image downloads are denied when the initial download request redirects to a hostname such ascdn01.quay.io. -
Set your firewall’s allowlist to include any site that provides resources for a language or framework that your builds require.
-
If you do not disable Telemetry, you must grant access to the following URLs to access Red Hat Insights:
URL Port Function cert-api.access.redhat.com443
Required for Telemetry
api.access.redhat.com443
Required for Telemetry
infogw.api.openshift.com443
Required for Telemetry
console.redhat.com443
Required for Telemetry and for
insights-operator -
If you use Alibaba Cloud, Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) to host your cluster, you must grant access to the URLs that offer the cloud provider API and DNS for that cloud:
Cloud URL Port Function Alibaba
*.aliyuncs.com443
Required to access Alibaba Cloud services and resources. Review the Alibaba endpoints_config.go file to find the exact endpoints to allow for the regions that you use.
AWS
aws.amazon.com443
Used to install and manage clusters in an AWS environment.
*.amazonaws.comAlternatively, if you choose to not use a wildcard for AWS APIs, you must include the following URLs in your allowlist:
443
Required to access AWS services and resources. Review the AWS Service Endpoints in the AWS documentation to find the exact endpoints to allow for the regions that you use.
ec2.amazonaws.com443
Used to install and manage clusters in an AWS environment.
events.amazonaws.com443
Used to install and manage clusters in an AWS environment.
iam.amazonaws.com443
Used to install and manage clusters in an AWS environment.
route53.amazonaws.com443
Used to install and manage clusters in an AWS environment.
*.s3.amazonaws.com443
Used to install and manage clusters in an AWS environment.
*.s3.<aws_region>.amazonaws.com443
Used to install and manage clusters in an AWS environment.
*.s3.dualstack.<aws_region>.amazonaws.com443
Used to install and manage clusters in an AWS environment.
sts.amazonaws.com443
Used to install and manage clusters in an AWS environment.
sts.<aws_region>.amazonaws.com443
Used to install and manage clusters in an AWS environment.
tagging.us-east-1.amazonaws.com443
Used to install and manage clusters in an AWS environment. This endpoint is always
us-east-1, regardless of the region the cluster is deployed in.ec2.<aws_region>.amazonaws.com443
Used to install and manage clusters in an AWS environment.
elasticloadbalancing.<aws_region>.amazonaws.com443
Used to install and manage clusters in an AWS environment.
servicequotas.<aws_region>.amazonaws.com443
Required. Used to confirm quotas for deploying the service.
tagging.<aws_region>.amazonaws.com443
Allows the assignment of metadata about AWS resources in the form of tags.
*.cloudfront.net443
Used to provide access to CloudFront. If you use the AWS Security Token Service (STS) and the private S3 bucket, you must provide access to CloudFront.
GCP
*.googleapis.com443
Required to access GCP services and resources. Review Cloud Endpoints in the GCP documentation to find the endpoints to allow for your APIs.
accounts.google.com443
Required to access your GCP account.
Microsoft Azure
management.azure.com443
Required to access Microsoft Azure services and resources. Review the Microsoft Azure REST API reference in the Microsoft Azure documentation to find the endpoints to allow for your APIs.
*.blob.core.windows.net443
Required to download Ignition files.
login.microsoftonline.com443
Required to access Microsoft Azure services and resources. Review the Azure REST API reference in the Microsoft Azure documentation to find the endpoints to allow for your APIs.
-
Allowlist the following URLs:
URL Port Function mirror.openshift.com443
Required to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
storage.googleapis.com/openshift-release443
A source of release image signatures, although the Cluster Version Operator needs only a single functioning source.
*.apps.<cluster_name>.<base_domain>443
Required to access the default cluster routes unless you set an ingress wildcard during installation.
quayio-production-s3.s3.amazonaws.com443
Required to access Quay image content in AWS.
api.openshift.com443
Required both for your cluster token and to check if updates are available for the cluster.
rhcos.mirror.openshift.com443
Required to download Red Hat Enterprise Linux CoreOS (RHCOS) images.
console.redhat.com443
Required for your cluster token.
sso.redhat.com443
The
https://console.redhat.comsite uses authentication fromsso.redhat.comOperators require route access to perform health checks. Specifically, the authentication and web console Operators connect to two routes to verify that the routes work. If you are the cluster administrator and do not want to allow
*.apps.<cluster_name>.<base_domain>, then allow these routes:-
oauth-openshift.apps.<cluster_name>.<base_domain> -
console-openshift-console.apps.<cluster_name>.<base_domain>, or the hostname that is specified in thespec.route.hostnamefield of theconsoles.operator/clusterobject if the field is not empty.
-
-
Allowlist the following URLs for optional third-party content:
URL Port Function registry.connect.redhat.com443
Required for all third-party images and certified operators.
rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com443
Provides access to container images hosted on
registry.connect.redhat.comoso-rhc4tp-docker-registry.s3-us-west-2.amazonaws.com443
Required for Sonatype Nexus, F5 Big IP operators.
-
If you use a default Red Hat Network Time Protocol (NTP) server allow the following URLs:
-
1.rhel.pool.ntp.org -
2.rhel.pool.ntp.org -
3.rhel.pool.ntp.org
-
|
If you do not use a default Red Hat NTP server, verify the NTP server for your platform and allow it in your firewall. |
Additional resources
OpenShift Container Platform network flow matrix
The network flow matrix describes the ingress flows to OpenShift Container Platform services. The network information in the matrix is accurate for both bare-metal and cloud environments. Use the information in the network flow matrix to help you manage ingress traffic. You can restrict ingress traffic to essential flows to improve network security.
To view or download the raw CSV content, see this resource.
Additionally, consider the following dynamic port ranges when managing ingress traffic:
-
9000-9999: Host level services -
3000-32767: Kubernetes node ports -
49152-65535: Dynamic or private ports
|
The network flow matrix describes ingress traffic flows for a base OpenShift Container Platform installation. It does not describe network flows for additional components, such as optional Operators available from the Red Hat Marketplace. The matrix does not apply for Hosted-Control-Plane, MicroShift, or standalone clusters. |
| Direction | Protocol | Port | Namespace | Service | Pod | Container | Node Role | Optional |
|---|---|---|---|---|---|---|---|---|
Ingress |
TCP |
22 |
Host system service |
sshd |
master |
TRUE |
||
Ingress |
TCP |
53 |
openshift-dns |
dns-default |
dnf-default |
dns |
master |
FALSE |
Ingress |
TCP |
111 |
Host system service |
rpcbind |
master |
TRUE |
||
Ingress |
TCP |
2379 |
openshift-etcd |
etcd |
etcd |
etcdctl |
master |
FALSE |
Ingress |
TCP |
2380 |
openshift-etcd |
healthz |
etcd |
etcd |
master |
FALSE |
Ingress |
TCP |
5050 |
openshift-machine-api |
ironic-proxy |
ironic-proxy |
master |
FALSE |
|
Ingress |
TCP |
6080 |
openshift-kube-apiserver |
kube-apiserver |
kube-apiserver-insecure-readyz |
master |
FALSE |
|
Ingress |
TCP |
6385 |
openshift-machine-api |
ironic-proxy |
ironic-proxy |
master |
FALSE |
|
Ingress |
TCP |
6443 |
openshift-kube-apiserver |
apiserver |
kube-apiserver |
kube-apiserver |
master |
FALSE |
Ingress |
TCP |
8080 |
openshift-network-operator |
network-operator |
network-operator |
master |
FALSE |
|
Ingress |
TCP |
8798 |
openshift-machine-config-operator |
machine-config-daemon |
machine-config-daemon |
machine-config-daemon |
master |
FALSE |
Ingress |
TCP |
9001 |
openshift-machine-config-operator |
machine-config-daemon |
machine-config-daemon |
kube-rbac-proxy |
master |
FALSE |
Ingress |
TCP |
9099 |
openshift-cluster-version |
cluster-version-operator |
cluster-version-operator |
cluster-version-operator |
master |
FALSE |
Ingress |
TCP |
9100 |
openshift-monitoring |
node-exporter |
node-exporter |
kube-rbac-proxy |
master |
FALSE |
Ingress |
TCP |
9103 |
openshift-ovn-kubernetes |
ovn-kubernetes-node |
ovnkube-node |
kube-rbac-proxy-node |
master |
FALSE |
Ingress |
TCP |
9104 |
openshift-network-operator |
metrics |
network-operator |
network-operator |
master |
FALSE |
Ingress |
TCP |
9105 |
openshift-ovn-kubernetes |
ovn-kubernetes-node |
ovnkube-node |
kube-rbac-proxy-ovn-metrics |
master |
FALSE |
Ingress |
TCP |
9107 |
openshift-ovn-kubernetes |
egressip-node-healthcheck |
ovnkube-node |
ovnkube-controller |
master |
FALSE |
Ingress |
TCP |
9108 |
openshift-ovn-kubernetes |
ovn-kubernetes-control-plane |
ovnkube-control-plane |
kube-rbac-proxy |
master |
FALSE |
Ingress |
TCP |
9192 |
openshift-cluster-machine-approver |
machine-approver |
machine-approver |
kube-rbac-proxy |
master |
FALSE |
Ingress |
TCP |
9258 |
openshift-cloud-controller-manager-operator |
machine-approver |
cluster-cloud-controller-manager |
cluster-cloud-controller-manager |
master |
FALSE |
Ingress |
TCP |
9444 |
openshift-kni-infra |
haproxy |
haproxy |
master |
FALSE |
|
Ingress |
TCP |
9445 |
openshift-kni-infra |
haproxy |
haproxy |
master |
FALSE |
|
Ingress |
TCP |
9447 |
openshift-machine-api |
metal3-baremetal-operator |
master |
FALSE |
||
Ingress |
TCP |
9537 |
Host system service |
crio-metrics |
master |
FALSE |
||
Ingress |
TCP |
9637 |
openshift-machine-config-operator |
kube-rbac-proxy-crio |
kube-rbac-proxy-crio |
kube-rbac-proxy-crio |
master |
FALSE |
Ingress |
TCP |
9978 |
openshift-etcd |
etcd |
etcd |
etcd-metrics |
master |
FALSE |
Ingress |
TCP |
9979 |
openshift-etcd |
etcd |
etcd |
etcd-metrics |
master |
FALSE |
Ingress |
TCP |
9980 |
openshift-etcd |
etcd |
etcd |
etcd |
master |
FALSE |
Ingress |
TCP |
10250 |
Host system service |
kubelet |
master |
FALSE |
||
Ingress |
TCP |
10256 |
openshift-ovn-kubernetes |
ovnkube |
ovnkube |
ovnkube-controller |
master |
FALSE |
Ingress |
TCP |
10257 |
openshift-kube-controller-manager |
kube-controller-manager |
kube-controller-manager |
kube-controller-manager |
master |
FALSE |
Ingress |
TCP |
10258 |
openshift-cloud-controller-manager-operator |
cloud-controller |
cloud-controller-manager |
cloud-controller-manager |
master |
FALSE |
Ingress |
TCP |
10259 |
openshift-kube-scheduler |
scheduler |
openshift-kube-scheduler |
kube-scheduler |
master |
FALSE |
Ingress |
TCP |
10260 |
openshift-cloud-controller-manager-operator |
cloud-controller |
cloud-controller-manager |
cloud-controller-manager |
master |
FALSE |
Ingress |
TCP |
10300 |
openshift-cluster-csi-drivers |
csi-livenessprobe |
csi-driver-node |
csi-driver |
master |
FALSE |
Ingress |
TCP |
10309 |
openshift-cluster-csi-drivers |
csi-node-driver |
csi-driver-node |
csi-node-driver-registrar |
master |
FALSE |
Ingress |
TCP |
10357 |
openshift-kube-apiserver |
openshift-kube-apiserver-healthz |
kube-apiserver |
kube-apiserver-check-endpoints |
master |
FALSE |
Ingress |
TCP |
17697 |
openshift-kube-apiserver |
openshift-kube-apiserver-healthz |
kube-apiserver |
kube-apiserver-check-endpoints |
master |
FALSE |
Ingress |
TCP |
18080 |
openshift-kni-infra |
coredns |
coredns |
master |
FALSE |
|
Ingress |
TCP |
22623 |
openshift-machine-config-operator |
machine-config-server |
machine-config-server |
machine-config-server |
master |
FALSE |
Ingress |
TCP |
22624 |
openshift-machine-config-operator |
machine-config-server |
machine-config-server |
machine-config-server |
master |
FALSE |
Ingress |
UDP |
53 |
openshift-dns |
dns-default |
dnf-default |
dns |
master |
FALSE |
Ingress |
UDP |
111 |
Host system service |
rpcbind |
master |
TRUE |
||
Ingress |
UDP |
6081 |
openshift-ovn-kubernetes |
ovn-kubernetes geneve |
master |
FALSE |
||
Ingress |
TCP |
22 |
Host system service |
sshd |
worker |
TRUE |
||
Ingress |
TCP |
53 |
openshift-dns |
dns-default |
dnf-default |
dns |
worker |
FALSE |
Ingress |
TCP |
80 |
openshift-ingress |
router-default |
router-default |
router |
worker |
FALSE |
Ingress |
TCP |
111 |
Host system service |
rpcbind |
worker |
TRUE |
||
Ingress |
TCP |
443 |
openshift-ingress |
router-default |
router-default |
router |
worker |
FALSE |
Ingress |
TCP |
8798 |
openshift-machine-config-operator |
machine-config-daemon |
machine-config-daemon |
machine-config-daemon |
worker |
FALSE |
Ingress |
TCP |
9001 |
openshift-machine-config-operator |
machine-config-daemon |
machine-config-daemon |
kube-rbac-proxy |
worker |
FALSE |
Ingress |
TCP |
9100 |
openshift-monitoring |
node-exporter |
node-exporter |
kube-rbac-proxy |
worker |
FALSE |
Ingress |
TCP |
9103 |
openshift-ovn-kubernetes |
ovn-kubernetes-node |
ovnkube-node |
kube-rbac-proxy-node |
worker |
FALSE |
Ingress |
TCP |
9105 |
openshift-ovn-kubernetes |
ovn-kubernetes-node |
ovnkube-node |
kube-rbac-proxy-ovn-metrics |
worker |
FALSE |
Ingress |
TCP |
9107 |
openshift-ovn-kubernetes |
egressip-node-healthcheck |
ovnkube-node |
ovnkube-controller |
worker |
FALSE |
Ingress |
TCP |
9537 |
Host system service |
crio-metrics |
worker |
FALSE |
||
Ingress |
TCP |
9637 |
openshift-machine-config-operator |
kube-rbac-proxy-crio |
kube-rbac-proxy-crio |
kube-rbac-proxy-crio |
worker |
FALSE |
Ingress |
TCP |
10250 |
Host system service |
kubelet |
worker |
FALSE |
||
Ingress |
TCP |
10256 |
openshift-ovn-kubernetes |
ovnkube |
ovnkube |
ovnkube-controller |
worker |
TRUE |
Ingress |
TCP |
10300 |
openshift-cluster-csi-drivers |
csi-livenessprobe |
csi-driver-node |
csi-driver |
worker |
FALSE |
Ingress |
TCP |
10309 |
openshift-cluster-csi-drivers |
csi-node-driver-registrar |
csi-driver-node |
csi-node-driver-registrar |
worker |
FALSE |
Ingress |
TCP |
18080 |
openshift-kni-infra |
coredns |
coredns |
worker |
FALSE |
|
Ingress |
UDP |
53 |
openshift-dns |
dns-default |
dnf-default |
dns |
worker |
FALSE |
Ingress |
UDP |
111 |
Host system service |
rpcbind |
worker |
TRUE |
||
Ingress |
UDP |
6081 |
openshift-ovn-kubernetes |
ovn-kubernetes geneve |
worker |
FALSE |