You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Use this guide to implement egress restrictions for {product-title} on {GCP} by using {GCP}'s Next Generation Firewall (NGFW). NGFW is a fully distributed firewall service that allows fully qualified domain name (FQDN) objects in firewall policy rules. This is necessary for many of the external endpoints that {product-title} relies on.
11
+
Implement egress restrictions for {product-title} on {GCP} by using Next Generation Firewall (NGFW), which allows fully qualified domain name (FQDN)-based firewall rules required for {product-title}external endpoints.
* link:https://docs.redhat.com/en/documentation/openshift_dedicated/4/html/planning_your_environment/gcp-ccs#osd-gcp-psc-firewall-prerequisites_gcp-ccs[Firewall prerequisites for {GCP}]
51
+
* link:https://cloud.google.com/firewall/docs/use-network-firewall-policies[Use global network firewall policies and rules]
This guide demonstrates how to modify the hostname and TLS certificate of the Web console, OAuth server, and Downloads component routes in {product-title} on {GCP} version 4.14 and above.{fn-supported-versions}
12
-
13
-
The changes that we make to the component routes{fn-term-component-routes} in this guide are described in greater detail in the link:https://docs.openshift.com/container-platform/latest/authentication/configuring-internal-oauth.html#customizing-the-oauth-server-url_configuring-internal-oauth[Customing the internal OAuth server URL], link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/web_console/customizing-web-console#customizing-the-console-route_customizing-web-console[Customing the console route], and link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/web_console/customizing-web-console#customizing-the-download-route_customizing-web-console[Customing the download route] {product-title} documentation.
14
-
15
-
[id="prerequisites_{context}"]
16
-
== Prerequisites
17
-
* OCM CLI (`ocm`) version 1.0.5 or higher
18
-
* gcloud CLI (`gcloud`)
19
-
* An {product-title} on {GCP} cluster version 4.14 or higher
20
-
// +
21
-
// [NOTE]
22
-
// ====
23
-
// ROSA with HCP is not supported at this time.
24
-
// ====
25
-
// +
26
-
* {oc-first}
27
-
* `jq` CLI
28
-
* Access to the cluster as a user with the `cluster-admin` role.
29
-
* OpenSSL (for generating the demonstration SSL/TLS certificates)
11
+
Change the hostname and Transport Layer Security (TLS) certificate of the web console, OAuth server, and Downloads component routes to use custom domains that align with your organization's branding and security requirements.
12
+
13
+
[IMPORTANT]
14
+
====
15
+
Red Hat experts authored this content, but it has not yet been tested on every supported configuration.
* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/authentication_and_authorization/configuring-internal-oauth#customizing-the-oauth-server-url_configuring-internal-oauth[Customizing the internal OAuth server URL]
* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/web_console/customizing-web-console#customizing-the-console-route_customizing-web-console[Customizing the console route]
39
+
* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/web_console/customizing-web-console#customizing-the-download-route_customizing-web-console[Customizing the download route]
To prevent ongoing charges, after you delete your cluster you must manually delete the {GCP} networking infrastructure you created as part of this tutorial. Deleting the cluster will not automatically remove these underlying resources. You can clean up these resources using a combination of gcloud CLI commands and actions within the {GCP} console.
11
-
12
-
Before you begin the process of cleaning up the resources you created for this tutorial, run the following commands and complete any prompts.
13
-
10
+
Delete the {GCP} networking infrastructure after deleting your cluster to prevent ongoing charges. The cluster deletion does not automatically remove virtual private cloud (VPC) networks, subnets, firewall policies, or domain name system (DNS) zones.
14
11
15
12
.Procedure
16
-
. To authenticate your identity run the following command:
13
+
. Authenticate by running the following command:
17
14
+
18
15
[source,terminal]
19
16
----
20
17
$ gcloud init
21
18
----
22
19
+
23
-
. To log in to your {GCP} account, run the following command:
20
+
. Log in to your {GCP} account by running the following command:
24
21
+
25
22
[source,terminal]
26
23
----
27
24
$ gcloud auth application-default login
28
25
----
29
26
+
30
-
. To log in to the {cluster-manager} CLI tool, run the following command:
27
+
. Log in to the {cluster-manager} CLI tool by running the following command:
31
28
+
32
29
[source,terminal]
33
30
----
34
31
$ ocm login --use-auth-code
35
32
----
36
33
+
37
-
You are now ready to clean up the resources you created as part of this tutorial. To respect resource dependencies, delete them in the reverse order of their creation.
34
+
You can now clean up the resources you created as part of this tutorial. To respect resource dependencies, delete them in the reverse order of their creation.
38
35
39
-
. Delete the firewall policy's association with the VPC by running the following command:
36
+
. Delete the association of the firewall policy with the VPC by running the following command:
. A managed DNS zone in {GCP} cannot be deleted until all user-defined record sets are removed. Define variables to target the specific {GCP} project and the managed DNS zone being cleaned up by running the following command:
= Creating a Cloud Router and a Cloud Network Address Translation gateway
7
+
= Creating a Cloud Router and Cloud network address translation
8
8
9
9
[role="_abstract"]
10
-
The Network Address Translation (NAT) gateway enables internet connectivity for your private VMs by masquerading all their traffic under a single public IP address. As the designated exit point, it translates their internal IPs for any outbound requests, such as fetching updates. This process effectively grants them access to the internet without ever exposing their private addresses.
10
+
Create a Cloud Router and Cloud network address translation (NAT). Private VMs can use the internet while their private IP addresses stay hidden.
11
11
12
12
.Procedure
13
13
. Reserve an IP address for Cloud NAT by running the following command:
Copy file name to clipboardExpand all lines: modules/cloud-experts-osd-limit-egress-ngfw-create-firewall-rules.adoc
+22-3Lines changed: 22 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,10 +7,10 @@
7
7
= Creating the firewall rules
8
8
9
9
[role="_abstract"]
10
-
You need to create some firewall rules to allow your cluster to access the Web.
10
+
Create firewall rules for egress to private IP ranges and to the {product-title} domains listed in this procedure. Egress to other external destinations does not match these rules and is not permitted.
11
11
12
12
.Procedure
13
-
. Create a blanket allow rule for private IP (RFC 1918) address space by running the following command:
13
+
. Create a blanket allow rule for private IP (Request for Comments (RFC) 1918) address space by running the following command:
If there is not a matching rule that allows the traffic, it will be blocked by the firewall. To allow access to other resources, such as internal networks or other external endpoints, create additional rules with a priority of less than 1000. For more information on how to create firewall rules, see link:https://cloud.google.com/firewall/docs/use-network-firewall-policies[Use global network firewall policies and rules].
64
+
The firewall blocks any traffic if you did not create any matching rules. To allow access to other resources, such as internal networks or other external endpoints, create additional rules with a priority of less than 1000. For more information on how to create firewall rules, see the _Additional resources_.
0 commit comments