Self-Hosted Deployment

Amazon Web Services

Microsoft Azure

On premises

vpctl

Self-Hosted Deployment

此页面不支持所选语言。

Firewall rules for the outbound internet access

If you want to restrict outbound access, configure the required firewall rules

阅读时间1 分钟

最后更新于 1 个月前

If you want to restrict outbound access, implement these firewall rules:

Generic outbound configuration for the Azure Kubernetes Service (AKS) cluster, to lock down the traffic that leaves the AKS subnet. Refer to the required outbound network rules and fully qualified domain names (FQDNs) in the Microsoft documentation.
Access from the AKS cluster to the Azure Container Registry (ACR) that contains the container images of Self-Hosted Deployment:
- Login server:
```
https://uccmpprivatecloud.azurecr.io
```
- Data plane:
  - If dedicated data endpoints aren't enabled:
    - https://*.blob.core.windows.net
  - If dedicated data endpoints are enabled:
    - https://uccmpprivatecloud.eastus.data.azurecr.io
    - https://uccmpprivatecloud.northeurope.data.azurecr.io
Access from the AKS cluster, for AKS extension agents such as GitOps:
- ```
https://*.dp.kubernetesconfiguration.azure.com
```
Access from the AKS cluster to the enterprise identity provider, which Keycloak connects to in order to retrieve user tokens via a backchannel. Specific FQDNs depend on the IdP vendor, for example, it is
```
https://login.microsoftonline.com
```
for Microsoft Entra ID.
Access from the PostgreSQL servers to Entra ID, for traffic that leaves the PostgreSQL subnet. Refer to the description of private access networking for Azure Database for PostgreSQL flexible server in the Microsoft documentation.
- All traffic to the
```
AzureActiveDirectory
```
  service tag.