Network Requirements¶

Firefly needs to connect to the TLS Protect Cloud REST API, so you may have to configure your firewall or egress proxy accordingly.

Introduction¶

If Firefly is deployed in a secure environment that limits connection to external sites or services, you may need to configure your firewall with the following egress rule:

If you use an egress proxy you can assign the proxy address to an environment variable called HTTPS_PROXY, in the environment of the Firefly process. Firefly uses the Go HTTP library, which allows getting the proxy from the process environment.

The steps will be different, depending on whether you deploy Firefly on Kubernetes or on a VM using Docker.

Modifying network settings for Kubernetes¶

Egress using NetworkPolicy¶

Many Kubernetes clusters and most OpenShift clusters have NetworkPolicy enabled. NetworkPolicies allow you to limit how a Pod communicates over the network. NetworkPolicies apply to a connections between Pods in a cluster and also apply to connections between Pods and the Internet.

Here is an example of NetworkPolicy which will allow Firefly to connect to the TLS Protect Cloud REST API.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-firefly-egress
  namespace: venafi
spec:
  podSelector:
    matchLabels:
      app: firefly
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 443

Proxy Server Considerations¶

Some Kubernetes clusters are configured to only allow Internet connections via an HTTP(S) proxy. If that applies to you:

1. Add api.venafi.cloud (or https://api.venafi.eu/ if you are in Europe) to the allowed domain list of your egress proxy.
2. Add an HTTPS_PROXY environment variable to the PodTemplate of the Firefly Deployment resource.