Network and firewall requirements
Every connection the agent, UnitVane and the AI gateway make, with destination, port and when it happens, for firewall and proxy reviews.
On this page
Every connection starts inside your environment and goes out over HTTPS on port 443 unless a row says otherwise. Nothing in your clusters needs an inbound port, and KubeOn never connects to a cluster's API server. The one exception is GPU burst, which you turn on separately: burst nodes connect in to the burst gateway.
From each cluster: the agent
| Destination | Port | When |
|---|---|---|
Kubernetes API server, including metrics.k8s.io | 443 | Every run: read-only list and watch, and current pod usage |
| Prometheus in the cluster (optional) | 9090 | Every run, when prometheusUrl is set |
app.kubeon.io | 443 | Every run: register, ask for an upload link, and confirm the upload |
| KubeOn's object storage | 443 | Every run, to send the snapshot on the upload link KubeOn issued. The link names the host |
One address to allow
kubeon.directUpload: false in the agent's values and snapshots go through app.kubeon.io too, so it is the only destination your firewall or proxy needs to allow. The agent needs no cloud token service: it authenticates to KubeOn with its cluster token.At install and upgrade
registry.kubeon.io. To install from your own registry, mirror both and set image.repository in the agent's values.From each cluster: the KubeOn controller (opt-in)
Only on clusters where you turned on write access.
| Destination | Port | When |
|---|---|---|
app.kubeon.io | 443 | Every poll, 15 seconds with the node autoscaler and 30 seconds otherwise: report permissions, pull queued changes |
| Kubernetes API server | 443 | Applying the changes its features allow |
Managed node pools are resized from KubeOn, through the separate cloud automation role in your account.
From each cluster: the GPU optimizer (opt-in)
| Destination | Port | When |
|---|---|---|
Your workspace on kubeon.io | 443 | Every poll, 60 seconds by default: pull policies and approvals, report actions |
| Kubernetes API server | 443 | Watching GPU nodes and pods, and applying the changes its policies allow |
| Prometheus in the cluster | 9090 | Reading DCGM metrics |
| Your cloud's compute APIs | 443 | Only with managed node groups or GPU burst |
GPU burst
From the hub
These connections leave the hub's network, so you only need to allow KubeOn's read-only identity in your cloud account. UnitVane makes the same billing reads, plus Oracle Cloud and OpenCost where you connect them.
| Destination | Port | When |
|---|---|---|
| AWS: Amazon Athena, AWS Glue and the CUR and Athena results buckets in Amazon S3 | 443 | Daily billing read, and backfills |
| Azure: Blob Storage for the cost export, and Cost Management | 443 | Daily billing read, and backfills |
| Google Cloud: BigQuery | 443 | Daily billing read, and backfills |
| Slack, Microsoft Teams and your webhook targets | 443 | Notifications you configure. Webhook targets must be public HTTPS addresses |
| Your SMTP server | 587 | Email notifications, with STARTTLS |
| Your SAML or OIDC identity provider | 443 | Sign-in |
| The model endpoint you choose for Ask KubeOn | 443 | When someone asks a question |
To KubeOn and UnitVane: people and integrations
| Destination | Port | Who connects |
|---|---|---|
Your workspace address on kubeon.io | 443 | Browsers, and scripts calling the REST API |
finops.unitvane.com and the UnitVane Analytics address | 443 | UnitVane users, and Power BI, Tableau or Excel with read-only credentials |
UnitVane AI gateway
| From | Destination | Port | When |
|---|---|---|---|
| Your applications | gateway.unitvane.com | 443 | Every model request routed through the gateway |
| Gateway | Your model providers: Azure OpenAI, Amazon Bedrock, Google Vertex AI, OpenAI, Anthropic | 443 | Every routed request |
Read-only AI tokenomics needs no gateway traffic at all: UnitVane reads provider billing and telemetry like any other billing source. See connect AI providers.
SaaS only