Ports and egress
Same as Network and connectivity, reproduced here for better visibility.
One canonical source. If this table and the install page ever disagree, that is a bug in our publishing, not a judgement call for you. Report it.
Outbound
All TCP, all TLS, all outbound. Nothing needs an inbound rule from the internet.
| Destination | Port | Needed by | Purpose | Required |
|---|---|---|---|---|
api.gen0sec.com | 443 | Cluster pods, the relay only | Threat intelligence, GeoIP, ML models, IDS rules | Always |
releases.gen0sec.com | 443 | Workstation | Download the install kit and its signature | Always |
registry.gen0sec.com | 443 | Workstation | Pull charts and images | Always |
registry.gen0sec.com | 443 | Cluster nodes | Image pulls at install time | Registry install only |
fulcio.sigstore.dev | 443 | Workstation | Signature certificate verification | Always |
rekor.sigstore.dev | 443 | Workstation | Transparency log verification | Always |
tuf-repo-cdn.sigstore.dev | 443 | Workstation | Signature trust root refresh | Always |
| Your own registry | 443 or 80 | Cluster nodes, and the host that loads the bundle | Image pulls at install time | Offline bundle only |
helm.gen0sec.com | 443 | Cluster pods, the dashboard only | Latest agent version, shown on the Clients and Components pages | No. Always attempted. Blocking it only hides the latest version |
releases.gen0sec.com | 443 | Cluster pods, the dashboard only | Latest component versions | No. Only if an administrator turns on Check for updates online |
| Your SMTP server | 587 or 465 | Cluster pods, the dashboard only | Invitation and password-reset email | No. Only if you configure SMTP |
Only one row is required by the running cluster: api.gen0sec.com:443, and only the relay pod
uses it. The dashboard rows are optional: blocking them hides version information, or leaves
invitations and password resets without email. Everything else is install-time, and most of it is
your workstation rather than your cluster.
Inbound
| Source | Destination | Port | Purpose |
|---|---|---|---|
| Your agents | Your published address | 443 | Telemetry, events, configuration, artifact download |
| Your users | Your published address | 443 | Dashboard |
One address serves both, routed by path prefix. See Publish the endpoints.
In-cluster
No NetworkPolicy is required, and none ships. If you enforce default-deny, these are the flows to allow.
| From | To | Port |
|---|---|---|
gen0sec services | core-pooler.gen0sec-system (Postgres pooler) | 5432 |
| Migration job | core.gen0sec-system (Postgres primary) | 5432 |
gen0sec services | core-kafka-bootstrap.gen0sec-system | 9092 |
gen0sec services | rustfs-svc.gen0sec-system (object store) | 9000 |
gen0sec services | dragonfly.gen0sec-system (cache) | 6379 |
| Ingress controller | gen0sec services | Service ports |
gen0sec services | gen0sec services | Service ports |
Dashboard (ui) pods | The Kubernetes API server | 443 or 6443 |
The dashboard reads two ConfigMaps from the API server for the Components tab. Find its address with
kubectl get endpoints kubernetes -n default. Without that flow only the Components tab degrades.
See Hardening for what we recommend beyond that.
Notes that save time
The Sigstore hosts are the ones people forget. Signature verification is the first command of the install, and it fails without them. They are needed on the workstation, not on the cluster.
A proxy does not help for the cluster's one destination. Explicit forward proxies are not honoured in-cluster. See Known limitations.
The offline bundle removes registry egress, not all egress. The runtime connection stays. See What this rules out.