Migrate to the standalone HTTPS gateway

After you upgrade to release 1.3 on Red Hat Enterprise Linux, move administrators, automation, and integrations from per-service HTTPS ports to the unified gateway on port 443, then optionally disable legacy API ports.

Before you begin

Procedure

  1. Confirm that the gateway is active: 
    sudo systemctl status flightctl-gateway.service
  2. Review which legacy ports are still in use on the host: 
    sudo ss -tlnp | grep -E ':443|:3443|:7443|:8090|:8444|:8445'

    Installations upgraded from an earlier release might still expose port 3443 (user API), 8090 (CLI artifacts), 8444 (sign-in integration), or 8445 (image builder API) for backward compatibility. These functions are now routed through the gateway on port 443 by using path prefixes (see Path-based routing on port 443).

  3. Update administrator and automation clients to the gateway URL:
    • Web console: https://<baseDomain>/
    • flightctl login: https://<baseDomain> (no port suffix)
    • REST and CI/CD jobs: https://<baseDomain>/api/v1/<resource> or https://<baseDomain>/_/flightctl/api/v1/<resource>
    • CLI downloads: use the help menu in the web console on port 443 instead of https://<baseDomain>:8090
    • Operating system image build clients: use path-based access on port 443 (/_/imagebuilder/) instead of https://<baseDomain>:8445 unless you still rely on the legacy listener
  4. Update OIDC or Red Hat Ansible Automation Platform redirect URIs, OAuth application settings, and any hard-coded URLs in playbooks to use https://<baseDomain>/ on port 443.
  5. Test end-to-end flows:
    • Sign in to the web console.
    • Run flightctl login https://<baseDomain> --web (or with --username and --password) and a representative API command.
    • Enroll or sync a test device (agent traffic still uses port 7443).
    • If you use image builds or external alerting, confirm those integrations against the new URLs.
  6. Tighten firewall rules toward the target state:
    • Require inbound TCP 443 for administrative HTTPS access.
    • Keep inbound TCP 7443 for the agent API.
    • Remove rules for ports 3443, 8090, 8444, and 8445 when no client still uses them.
  7. When all clients use the gateway on port 443, disable legacy API listeners on the gateway by setting gateway.suppressOldPorts to true in /etc/flightctl/service-config.yaml: 
    gateway:
  suppressOldPorts: true
    Note

    If you omit the gateway section or set suppressOldPorts to false, the gateway continues to serve ports 3443 and 8445 for existing clients. Set suppressOldPorts to true after you migrate all clients.

    Restart Flight Control:

    sudo systemctl restart flightctl.target
  8. Verify that legacy ports are no longer required: 
    curl -k -o /dev/null -w '%{http_code}\n' https://<baseDomain>/api/v1/health
curl -k -o /dev/null -w '%{http_code}\n' https://<baseDomain>:3443/api/v1/health

    The second command should fail or be blocked by your firewall after migration.

Results

  • curl -k -o /dev/null -w '%{http_code}\n' https://<baseDomain>/ returns 200 or a redirect.
  • flightctl login https://<baseDomain> --web succeeds for a valid user.
  • Legacy ports (3443, 8090, 8444, 8445) are no longer reachable when suppressOldPorts is true.