What IPv4 addresses or DNS domains must be whitelisted within my network in order to access quay.io?

Environment

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat OpenShift Container Platform 3
• Red Hat OpenShift Container Platform 4

Issue

• Within my private network, access to quay.io does not work as the correct DNS domains or IPv4 addresses have not been whitelisted.
• What addresses and DNS domains must currently be whitelisted by my network and security appliances and infrastructure to allow for access to quay.io, most notably for pulling and pushing container images?

Resolution

• Currently, only a wildcard DNS entry for access to quay.io within your network will guaranteed work long-term for gaining access to pushing and pulling images to or from the service.
• This is documented as requiring the DNS wildcard entry of *.quay.io to be allowed within private networks in order to guarantee access to services and content provided by quay.io within the OpenShift Container Platform Firewall Requirements.
• At the time of this writing, there is no guaranteed static addresses that resolve to quay.io as the content delivery network may change addresses at any time, hence the wildcard requirement.
• The following command will give you current resolved addresses to the quay.io addresses, but as noted above, these addresses may change at any time:

$ dig @8.8.8.8 quay.io | grep -A9 "ANSWER SECTION"
;; ANSWER SECTION:
quay.io.                10      IN      A       54.197.99.84
quay.io.                10      IN      A       52.4.104.248
quay.io.                10      IN      A       34.224.196.162
quay.io.                10      IN      A       50.16.140.223
quay.io.                10      IN      A       3.213.173.170
quay.io.                10      IN      A       54.156.10.58
quay.io.                10      IN      A       3.233.133.41
quay.io.                10      IN      A       34.197.63.98

• There is currently a feature request to remove the DNS wildcard requirements for access to the quay.io addresses, so that static addresses can be utilized instead, but no ETA currently exists.
• Please open a support case with Red Hat Customer Support for status checks on this feature request.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.