Network and firewall requirements
Every connection the agent, hub and AI gateway make, with destination, port and when it happens, for firewall and proxy reviews.
On this page
Every connection starts inside your environment and goes out over HTTPS on port 443 unless a row says otherwise. Nothing in your clusters needs an inbound port, and the hub never connects to a cluster's API server.
From each cluster: the agent
| Destination | Port | When |
|---|---|---|
Kubernetes API server, including metrics.k8s.io | 443 | Every run: read-only list and watch, and current pod usage |
| Prometheus in the cluster (optional) | 9090 | Every run, when prometheus.url is set |
| Your object storage: Amazon S3, Google Cloud Storage or Azure Blob Storage | 443 | Every run, when a self-hosted hub collects snapshots from your bucket |
ingest.kubeon.io | 443 | Every run, when snapshots go to KubeOn Cloud |
| Your cloud's token service (AWS STS, Microsoft Entra ID or Google STS) | 443 | Every run, to exchange the workload identity token |
At install and upgrade
Helm downloads charts from
charts.kubeon.io, and nodes pull images from ghcr.io/kubeon. On networks without internet egress, mirror both to your own registry: see self-hosted hub on Kubernetes.From the hub
On KubeOn Cloud these connections leave KubeOn's network, so you only need to allow KubeOn's read-only identity in your cloud account. On a self-hosted hub, allow them from the hub's network.
| Destination | Port | When |
|---|---|---|
| AWS: Amazon Athena, AWS Glue and the CUR and Athena results buckets in Amazon S3 | 443 | Daily billing read, and backfills |
| Azure: Blob Storage for the cost export, and Cost Management | 443 | Daily billing read, and backfills |
| Google Cloud: BigQuery | 443 | Daily billing read, and backfills |
| Slack, Microsoft Teams and your webhook targets | 443 | Notifications you configure. Webhook targets must be public HTTPS addresses |
| Your SMTP server | 587 | Email notifications, with STARTTLS |
| Your SAML or OIDC identity provider | 443 | Sign-in |
| The model endpoint you choose for Ask KubeOn | 443 | When someone asks a question |
To KubeOn: people and integrations
| Destination | Port | Who connects |
|---|---|---|
Your workspace address on kubeon.io (KubeOn Cloud) | 443 | Browsers, and scripts or BI tools calling the REST API |
| Your hub's address (self-hosted) | 443 | The same, inside your network. The hub sits behind an internal load balancer by default |
KubeOn AI gateway
| From | Destination | Port | When |
|---|---|---|---|
| Your applications | gateway.kubeon.io (KubeOn AI Cloud), or the gateway Service in your cluster | 443 | Every model request routed through the gateway |
| Gateway | Your model providers: Azure OpenAI, Amazon Bedrock, Google Vertex AI, OpenAI, Anthropic | 443 | Every routed request |
| Self-hosted gateway | Your hub's address | 443 | Reports usage and cost to the hub |
| Self-hosted gateway | Your Redis, with TLS | 6379 | Rate limits, budgets and the response cache |
Read-only AI tokenomics needs no gateway traffic at all: the hub reads provider billing and telemetry like any other billing source. See connect AI providers.
Networks without internet egress
- Run the hub in your data center with the Helm chart in hub mode.
- Mirror the
kubeonandkubeon-agentcharts and the images listed in the release notes to your registry. - Send snapshots to an S3-compatible store inside the network.
- Price clusters with a rate card instead of a cloud billing export.
Need help with this guide?Contact support