Egress communication for firewalls

If you are using a firewall or any other method to filter egress communication, please ensure that the following addresses are allowed for outbound communication. This is necessary to operate the in-cluster components.

All communication is directed to port 443, and all of it is encrypted with TLS. Note that not all traffic is plain HTTPS: the synchronizer uses secure WebSocket (wss, i.e. WebSocket over TLS) and the storage endpoint uses gRPC over TLS, both over port 443. If your firewall or proxy performs protocol-aware inspection, make sure it allows WebSocket and gRPC. Allowing "HTTPS only" will silently drop these connections even though the port is open.

📘

Prefer DNS/FQDN-based rules

The ARMO Platform endpoints are served behind a WAF / CDN service whose IP addresses are not under ARMO's control. They rotate over time and therefore cannot be reliably pinned, so always prefer DNS/FQDN-based firewall rules.

Only when FQDN-based rules are not possible, fall back to allowing the WAF/CDN provider's published IP ranges. Be aware this is a far broader allowance: those ranges are shared by many unrelated services hosted on the same provider, so allowing them weakens your egress controls. Treat it as a last resort, not an equivalent alternative to FQDN allowlisting.

ARMO Platform endpoints

Allow the set of domains matching the data center your account is provisioned in. You only need one region's domains (EU or US); allow both only if your deployment intentionally spans both regions. All endpoints are on port 443.

Vulnerability scanning (Grype)

Required only if image vulnerability scanning is enabled.

GitHub policy download (optional)

raw.githubusercontent.com is used only as an optional fallback for downloading the policy library. When the cluster is connected to the ARMO Platform, policies are served by the ARMO backend, so this endpoint is not required and the system operates normally without it. Allow it only if you want the extra redundancy.