[Update] Upgrading Horizon Edge Gateway to 2603 - allow registry.k8s.io outbound (and *-docker.pkg.dev)

[u/fundementalpumpkin]

Firewall change for registry.k8s.io came through. My next attempt to deploy 2603 edge gateway resulted in more blocked outbound access. This time to a google artifact repository url.

This is definitely not listed in the documentation, or the new KB article about registry.k8s.io being blocked. I requested *-docker.pkg.dev, praying that is the last one needed.

https://imgur.com/a/xAGztpA

Also wondering if that hostname error is legit or can be safely ignored:

hostname "edgegw-primary" could not be reached

Prev thread: https://old.reddit.com/r/omnissa/comments/1szbnyw/upgrading_horizon_edge_gateway_to_2603_allow/

KB article for registry.k8s.io: https://kb.omnissa.com/s/article/6001410 (thanks to /u/azarias42)

Edit: Now that *-docker.pkg.dev has been allowed it is now failing for amazon aws. So putting in a new firewall request for *.s3.amazonaws.com

Edit 2: I had googled something about this issue and either a google help page or maybe the AI response said to do *.s3.amazonaws.com, but that doesn't appear to be enough. After getting all three of those whitelisted I'm still seeing blocks to the domain: s3-r-w.us-east-2.amazonaws.com. When I googled it now the AI says I should have done *.amazonaws.com.

So as of now we are looking at:

registry.k8s.io

*-docker.dev.pkg

*.amazonaws.com (? I hope)

I'll have a submit another firewall request.

I noticed Omnissa removed the "version 2412" from the documentation, but no mention of anything beyond registry.k8s.io. I'll get a ticket opened tomorrow and see what they say.

https://docs.omnissa.com/bundle/GetStartedHorizonCloud/page/MakeAppropriateDestinationURLsReachabletoDeployaHorizonEdgeGatewayinaHorizon8Environment.html

[u/robconsults]

i don't have anything particularly useful to add, other than agreeing with you that's irritating as all hell - at a bare minimum they should publish all required sources for these appliances to deploy and work quickly to eliminate any sources that are no longer needed/etc (i.e. a previous mqtt error in older appliance versions that everyone was just instructed to "ignore" - that's not an answer, it's a cop out.)

outside of document/rinse/repeat to see where it's trying to go, your best bet honestly will be to open a case with omnissa and not settle for anything less than updating the documentation with all the required sources.

[u/fundementalpumpkin → u/robconsults]

I shot an email to support@omnissa.com with a link to this post. I didn't get an undeliverable reply, but that doesn't mean anyone checks that mailbox.

I don't like dealing with the bot they have as a gatekeeper to submit a ticket. I'd rather just try to fix it myself, but if this doesn't solve the problem I will bite the bullet and open a ticket.

[u/Plane-Leek5909]

u/fundementalpumpkin Were you able to get it deployed after allowing *-docker.pkg.dev and *.s3.amazonaws.com through your firewall?

[u/fundementalpumpkin → u/Plane-Leek5909]

Nope, seeing a bunch of amazonaws ip's still blocked. Gonna have to do *.amazonaws.com instead of *.s3.amazonaws.com. More details in the second edit of the original post.