Configuring your firewall

    Before you install OKD, you must configure your firewall to grant access to the sites that OKD requires.

    There are no special configuration considerations for services running on only controller nodes versus worker nodes.

    Procedure

    1. Allowlist the following registry URLs:

      When you add a site, such as quay.io, to your allowlist, do not add a wildcard entry, such as *.quay.io, to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, then image downloads are denied when the initial download request is redirected to a hostname such as cdn01.quay.io.

      CDN hostnames, such as cdn01.quay.io, are covered when you add a wildcard entry, such as *.quay.io, in your allowlist.

    2. Allowlist any site that provides resources for a language or framework that your builds require.

    3. If you use Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) to host your cluster, you must grant access to the URLs that provide the cloud provider API and DNS for that cloud:

    4. Allowlist the following URLs:

      Operators require route access to perform health checks. Specifically, the authentication and web console Operators connect to two routes to verify that the routes work. If you are the cluster administrator and do not want to allow *.apps.<cluster_name>.<base_domain>, then allow these routes:

      • oauth-openshift.apps.<cluster_name>.<base_domain>

    5. If you use a default Red Hat Network Time Protocol (NTP) server allow the following URLs:

      • 1.rhel.pool.ntp.org

      • 2.rhel.pool.ntp.org