Network firewall requirements for monitoring Kubernetes clusters

The table in the following sections specifies proxy and firewall configuration information for Microsoft Azure operated by 21Vianet. This information is required for the containerized agent to communicate with managed service for Prometheus and Container insights. All network traffic from the agent is outbound to Azure Monitor.

Microsoft Azure operated by 21Vianet cloud

Endpoint Purpose Port
*.ods.opinsights.azure.cn Data ingestion 443
*.oms.opinsights.azure.cn Azure Monitor agent onboarding 443
dc.services.visualstudio.com For agent telemetry that uses Azure public cloud Application Insights 443
global.handler.control.monitor.azure.cn Access control service 443
<cluster-region-name>.handler.control.monitor.azure.cn Fetch data collection rules for a specific cluster 443
*.ingest.monitor.azure.cn Container insights - logs ingestion endpoint 443
*.metrics.ingest.monitor.azure.cn Azure Monitor managed service for Prometheus - metrics ingestion endpoint 443
  • If you experience issues while you attempt to onboard the solution, review the troubleshooting guide.
  • With monitoring enabled to collect health and resource utilization of your Azure Kubernetes Service cluster and workloads running on them, learn how to use Container insights.