firewall issues

[EvertonSA]

ever since you migrated from partnership-public-images.jfrog.io to releases-pts-observability-fluentd.jfrog.io, I have image pull issues due to firewall.

I have been fighting with my network/security team to whitelist all redirects, but this is causing a lot of friction between network/security team and my team. they have the firewall, they have the firewall logs and i dont have access. they say nothing is blocked but it is.

I have managed to whitelist the following:

releases-pts-observability-fluentd.jfrog.io  
releases.jfrog.io  
endpointdns-prod-use1-lb.jfrog.io  
k8s-jfrogsaa-jfrogsaa-fb6f041eda-44b5904933c69ac1.elb.us-east-1.amazonaws.com
jfrog-prod-use1-shared-virginia-main.s3.amazonaws.com  
s3-1-w.amazonaws.com  
s3-w.us-east-1.amazonaws.com
jfrog-prod-use1-shared-virginia-main.s3.amazonaws.com 
s3-1-w.amazonaws.com 

but no success... question is, why this image is not on releases-docker.jfrog.io like all the images on the official charts?

[EvertonSA]

relates to #55 and #57

[EvertonSA]

https://hub.docker.com/r/evearakaki/jfrog-fluent i have been puling and pushing ever since

[MahithaB]

@EvertonSA can you please give me the exact error messages for the pull issues you have. Thanks!

[EvertonSA]

hi @MahithaB, I just tested this morning from the clusters i have the firewall whitelisting and it works 👀

from the cluster I have no firewall whitelisting, I get the following:

Failed to pull image "releases-pts-observability-fluentd.jfrog.io/fluentd:2.1": failed to pull and unpack image "releases-pts-observability-fluentd.jfrog.io/fluentd:2.1": failed to resolve reference "releases-pts-observability-fluentd.jfrog.io/fluentd:2.1": failed to do request: Head "https://releases-pts-observability-fluentd.jfrog.io/v2/fluentd/manifests/2.1": EOF

all these URL's below I was able to get from a tcpdump + wireshark analisys:

releases-pts-observability-fluentd.jfrog.io  
releases.jfrog.io  
endpointdns-prod-use1-lb.jfrog.io  
k8s-jfrogsaa-jfrogsaa-fb6f041eda-44b5904933c69ac1.elb.us-east-1.amazonaws.com
jfrog-prod-use1-shared-virginia-main.s3.amazonaws.com  
s3-1-w.amazonaws.com  
s3-w.us-east-1.amazonaws.com
jfrog-prod-use1-shared-virginia-main.s3.amazonaws.com 
s3-1-w.amazonaws.com 

without these (maybe not all of those) firewall whitelisting, the pull of the image fails dramatically.

what I as a paying enterprise + customer would like to see is the move of these official supported images to the official releases-docker.jfrog.io instead of releases-pts-observability-fluentd.jfrog.io. If you need a support ticket let me know I can open that in a few minutes.