Firewall openings for online installations

The domains for the services listed below need to be accessible from servers performing online installations. No outbound internet access is required for air gap installations.

For services hosted at domains owned by Replicated, the table includes a link to the list of IP addresses for the domain at replicatedhq/ips in GitHub. These are the addresses that Replicated services listen on, so they are the addresses that an online installation connects to.

That repository covers every Replicated service, so it lists more domains than any one installation needs. Use the table below to determine which of its entries apply to you.

note

Replicated does not publish the source IP addresses that its services use for outbound connections, such as when the Replicated proxy registry pulls an image from a vendor's registry, and does not commit to keeping those addresses stable. Do not use the addresses in replicatedhq/ips to build an allowlist for traffic originating from Replicated. Where access to a registry must be restricted, use registry credentials rather than a source IP allowlist.

Some of the domains listed below belong to public services that Replicated does not own, such as Docker Hub, GitHub and Amazon S3. Their IP addresses are not in replicatedhq/ips, so consult the provider's documentation for their ranges.

Replicated Embedded Cluster

For the complete list of Embedded Cluster installation requirements, see Embedded Cluster Installation Requirements.

Domain	Description
proxy.replicated.com	Private Docker images are proxied through proxy.replicated.com. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For the range of IP addresses for proxy.replicated.com, see replicatedhq/ips in GitHub.
replicated.app	Upstream application YAML and metadata is pulled from replicated.app. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to replicated.app. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For the range of IP addresses for replicated.app, see replicatedhq/ips in GitHub.
registry.replicated.com *	Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to registry.replicated.com. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA. For the range of IP addresses for registry.replicated.com, see replicatedhq/ips in GitHub.

* Required only if the application uses the Replicated private registry.

Helm CLI installations with Replicated

For more information about how to support Helm CLI installations with Replicated, see Install with Helm.

Domain	Description
replicated.app *	Required when the Replicated SDK is included. Application metadata is pulled from replicated.app, and the application sends its version, license ID, and application ID. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For IP addresses, see replicatedhq/ips.
registry.replicated.com	Required only for accounts not yet using the single-registry model. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For IP addresses, see replicatedhq/ips.
proxy.replicated.com	Private images and Helm charts are pulled through the proxy registry. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For IP addresses, see replicatedhq/ips.

* Required only if the Replicated SDK is included as a dependency of the application Helm chart.

note

Newer accounts route all image and chart pulls through proxy.replicated.com and do not need to allow registry.replicated.com. Older accounts must allow both. To move to the single-registry setup and remove registry.replicated.com from your allowlist, contact your Replicated account representative.

Replicated KOTS (existing cluster)

For the complete list of KOTS installation requirements, see KOTS Installation Requirements.

Domain	Description
Docker Hub	Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are index.docker.io, cdn.auth0.com, *.docker.io, and *.docker.com.
proxy.replicated.com *	Private Docker images are proxied through proxy.replicated.com. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For the range of IP addresses for proxy.replicated.com, see replicatedhq/ips in GitHub.
replicated.app	Upstream application YAML and metadata is pulled from replicated.app. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to replicated.app. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For the range of IP addresses for replicated.app, see replicatedhq/ips in GitHub.
registry.replicated.com **	Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to registry.replicated.com. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA. For the range of IP addresses for registry.replicated.com, see replicatedhq/ips in GitHub.
kots.io	Requests are made to this domain when installing the Replicated KOTS CLI. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.
github.com	Requests are made to this domain when installing the Replicated KOTS CLI. For information about retrieving GitHub IP addresses, see About GitHub's IP addresses in the GitHub documentation.

* Required only if the application uses the Replicated proxy registry.

** Required only if the application uses the Replicated registry.

Replicated kURL

For the complete list of kURL installation requirements, see kURL Installation Requirements.

Domain	Description
Docker Hub	Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are index.docker.io, cdn.auth0.com, *.docker.io, and *.docker.com.
proxy.replicated.com *	Private Docker images are proxied through proxy.replicated.com. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For the range of IP addresses for proxy.replicated.com, see replicatedhq/ips in GitHub.
replicated.app	Upstream application YAML and metadata is pulled from replicated.app. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to replicated.app. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For the range of IP addresses for replicated.app, see replicatedhq/ips in GitHub.
registry.replicated.com **	Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to registry.replicated.com. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA. For the range of IP addresses for registry.replicated.com, see replicatedhq/ips in GitHub.
k8s.kurl.sh s3.kurl.sh	kURL installation scripts and artifacts are served from kurl.sh. An application identifier is sent in a URL path, and bash scripts and binary executables are served from kurl.sh. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA. For the range of IP addresses for k8s.kurl.sh, see replicatedhq/ips in GitHub. The range of IP addresses for s3.kurl.sh are the same as IP addresses for the kurl.sh domain. For the range of IP address for kurl.sh, see replicatedhq/ips in GitHub.
amazonaws.com	tar.gz packages are downloaded from Amazon S3 during installations with kURL. For information about dynamically scraping the IP ranges to allowlist for accessing these packages, see AWS IP address ranges in the AWS documentation.

* Required only if the application uses the Replicated proxy registry.

** Required only if the application uses the Replicated registry.