Ports and egress
Same as Network and connectivity, reproduced here for better visibility.
One canonical source. If this table and the install page ever disagree, that is a bug in our publishing, not a judgement call for you. Report it.
Outbound
All TCP, all TLS, all outbound. Nothing needs an inbound rule from the internet.
| Destination | Port | Needed by | Purpose | Required |
|---|---|---|---|---|
api.gen0sec.com | 443 | Cluster pods, the relay only | Threat intelligence, GeoIP, ML models, IDS rules | Always |
releases.gen0sec.com | 443 | Workstation | Download the install kit and its signature | Always |
registry.gen0sec.com | 443 | Workstation | Pull charts and images | Always |
registry.gen0sec.com | 443 | Cluster nodes | Image pulls at install time | Registry install only |
fulcio.sigstore.dev | 443 | Workstation | Signature certificate verification | Always |
rekor.sigstore.dev | 443 | Workstation | Transparency log verification | Always |
tuf-repo-cdn.sigstore.dev | 443 | Workstation | Signature trust root refresh | Always |
| Your own registry | 443 or 80 | Cluster nodes, and the host that loads the bundle | Image pulls at install time | Offline bundle only |
Only one row applies to the running cluster in steady state: api.gen0sec.com:443, and only the
relay pod uses it. Everything else is install-time, and most of it is your workstation rather than
your cluster.
Inbound
| Source | Destination | Port | Purpose |
|---|---|---|---|
| Your agents | Your published address | 443 | Telemetry, events, configuration, artifact download |
| Your users | Your published address | 443 | Dashboard |
One address serves both, routed by path prefix. See Publish the endpoints.
In-cluster
No NetworkPolicy is required, and none ships. If you enforce default-deny, these are the flows to allow.
| From | To | Port |
|---|---|---|
gen0sec services | core-pooler.gen0sec-system (Postgres pooler) | 5432 |
| Migration job | core.gen0sec-system (Postgres primary) | 5432 |
gen0sec services | core-kafka-bootstrap.gen0sec-system | 9092 |
gen0sec services | rustfs-svc.gen0sec-system (object store) | 9000 |
gen0sec services | dragonfly.gen0sec-system (cache) | 6379 |
| Ingress controller | gen0sec services | Service ports |
See Hardening for what we recommend beyond that.
Notes that save time
The Sigstore hosts are the ones people forget. Signature verification is the first command of the install, and it fails without them. They are needed on the workstation, not on the cluster.
A proxy does not help for the cluster's one destination. Explicit forward proxies are not honoured in-cluster. See Known limitations.
The offline bundle removes registry egress, not all egress. The runtime connection stays. See What this rules out.