docs: Restructure Enteprise networking. #556
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,194 @@ | ||
| --- | ||
| title: "Networking" | ||
| description: Seqera configuration options for networking | ||
| date created: "2026-01-27" | ||
| last updated: "2026-05-21" | ||
| tags: [networking, configuration] | ||
| --- | ||
|
|
||
| Seqera Platform Enterprise requires inbound and outbound connections to external services: this page details the required ingress and egress networking considerations. | ||
|
|
||
| ## Introduction | ||
|
|
||
| Seqera-hosted services use dedicated IP addresses. To view the complete and up-to-date list of these IPs, consult the `ingress` and `egress` sections at https://meta.seqera.io/v3. | ||
|
|
||
| Seqera services, such as Wave, container registries, Nextflow plugin distribution, and others, use Cloudflare as a CDN for content delivery and caching. If you use these services and your firewall requires IP-based allowlists, you must allow all Cloudflare IP addresses in addition to IP addresses for Seqera services. For the complete list of Cloudflare IP addresses, see https://www.cloudflare.com/ips-v4/. | ||
|
|
||
| ## Platform vs Compute environment requirements | ||
|
|
||
| Understanding the distinction between Platform and Compute environment networking requirements is essential for configuring your firewall rules: | ||
|
|
||
| **Platform requirements** refer to the network connectivity required by your Seqera Platform instance. This includes connections for license validation, user authentication, access to platform resources, and management of pipeline definitions. These connections originate from the server or infrastructure where your Platform Enterprise application is installed. | ||
|
|
||
| **Compute environment requirements** refer to the network connectivity needed by the infrastructure where Nextflow pipeline jobs execute, which is provisioned on-demand by your Platform Enterprise installation. This includes connections for pulling pipeline code, downloading container images, accessing data sources, and using Seqera enterprise features, like Fusion or Wave. These connections originate from your compute resources (e.g., Kubernetes clusters, AWS Batch, Azure Batch, HPC clusters). | ||
|
|
||
| Refer to the [Platform architecture](../overview) for details on how Platform works. In many deployments, Platform and Compute environments are isolated from each other with different network security policies. Ensure you configure firewall rules for both environments according to their respective requirements. | ||
|
|
||
| ## Networking requirements | ||
|
|
||
| The following list is non-exhaustive and covers core networking connectivity requirements for operating Seqera Platform. Compute environment networking requirements will vary depending on pipeline configuration and specific dependencies for your use case. | ||
|
|
||
| ### Platform requirements | ||
|
|
||
| Your Seqera Platform instance requires network connectivity to only two core services: `licenses.seqera.io` for license validation and `cloudinfo.seqera.io` for cloud resource price prediction. All other services listed below are optional and depend on your specific configuration and feature usage. | ||
|
|
||
| To simplify firewall configuration, add `*.seqera.io` and `*.seqera.io.cdn.cloudflare.net` to your allowlist. If DNS wildcards aren't supported, allowlist the specific domains listed in each section below; if DNS hostnames aren't allowed in your allowlist, allow the `ingress` and `egress` sections at https://meta.seqera.io/v3 (ingress IPs are the ones that Seqera services listen on, egress IPs are the ones used by Seqera services to contact your infrastructure). | ||
|
justinegeffen marked this conversation as resolved.
Outdated
|
||
|
|
||
| #### License server (required) | ||
|
|
||
| Your Platform instance must communicate with `licenses.seqera.io` on port 443 for license validation. | ||
|
|
||
| #### Cloud resource pricing (required) | ||
|
|
||
| Your Platform instance must communicate with `cloudinfo.seqera.io` on port 443 for cloud resource price prediction and optimization. | ||
|
|
||
| #### Source code hosting providers | ||
|
|
||
| Platform must be allowed to access source code hosting providers to pull your pipeline definitions (e.g., GitHub, GitLab, Bitbucket, Gitea). Consult your source code hosting provider's documentation for specific networking requirements and IP allowlists. | ||
|
|
||
| #### Container registries | ||
|
|
||
| Platform must access container registries to pull container metadata and images (e.g., Docker Hub, Quay.io, AWS ECR, Azure ACR, Google GCR, or private registries), depending on which images are used in your pipelines. Consult your container registry provider's documentation for specific networking requirements and IP allowlists. | ||
|
Member
There was a problem hiding this comment. Shall we mention that these container registries are the ones hosting images defined in the pipelines the customers use? |
||
|
|
||
| #### Wave container services (optional) | ||
|
|
||
| Required only if using Seqera Cloud-hosted [Wave](https://docs.seqera.io/wave). Specific networking requirements will vary depending on pipeline configuration and use of Wave feature set. | ||
|
Member
There was a problem hiding this comment. Does Platform ever interact/pull data from CRs before submitting jobs that pull and use the images? @munishchouhan @pditommaso |
||
|
|
||
| - `wave.seqera.io` | ||
| - `public.cr.seqera.io` | ||
| - `auth.cr.seqera.io` | ||
| - `community.cr.seqera.io` | ||
| - `cerbero.seqera.io` | ||
|
justinegeffen marked this conversation as resolved.
Outdated
|
||
| - `private.cr.seqera.io` | ||
|
|
||
| #### Cloud provider APIs and services | ||
|
|
||
| Seqera Platform integrations may require access to data stored within your cloud environment, such as access logs and S3 buckets. If you have restricted access to these API endpoints, ensure that you allow connectivity from your Platform instance. | ||
|
|
||
| #### Reports and analytics (optional) | ||
|
|
||
| Required if using MultiQC report integration. | ||
|
justinegeffen marked this conversation as resolved.
Outdated
|
||
|
|
||
| - `api.multiqc.info` | ||
|
|
||
| ### Compute environment requirements | ||
|
|
||
| Your compute environments (where Nextflow jobs execute) require network connectivity to the following services. To simplify firewall configuration, add `*.seqera.io` and `*.seqera.io.cdn.cloudflare.net` to your allowlist. If DNS wildcards aren't supported, allowlist the specific domains listed in each section below. | ||
|
|
||
| :::note | ||
| If your allowlist is based on IP addresses, allow all Cloudflare IP addresses. For the complete list, see [https://www.cloudflare.com/ips-v4/](https://www.cloudflare.com/ips-v4/). | ||
|
|
||
| ::: | ||
|
|
||
| #### Source code hosting providers | ||
|
|
||
| Compute environments must access source code hosting providers to pull pipeline code (e.g., GitHub, GitLab, Bitbucket, Gitea). Consult your source code hosting provider's documentation for specific networking requirements and IP allowlists. | ||
|
|
||
| #### Container registries | ||
|
|
||
| Compute environments must access container registries to pull container images used by pipelines (e.g., Docker Hub, Quay.io, AWS ECR, Azure ACR, Google GCR, or private registries). Consult your container registry provider's documentation for specific networking requirements and IP allowlists. | ||
|
|
||
| #### License server (if using Fusion or Enterprise plugins) | ||
|
|
||
| [Fusion file system](../../supported_software/fusion/overview.md) and other Seqera Enterprise plugins have built-in license checking. Compute environments must communicate with `licenses.seqera.io` on port 443. For the most up-to-date list of IP addresses that your firewall must allow from compute environments, see the `ingress` section at [https://meta.seqera.io/v3](https://meta.seqera.io/v3). | ||
|
|
||
| - `licenses.seqera.io` | ||
|
|
||
| #### Fusion and nf-xpack | ||
|
|
||
| Required if using [Fusion file system](../../supported_software/fusion/overview.md) or other Seqera Enterprise plugins. | ||
|
Member
There was a problem hiding this comment. Is there any link to the Seqera Enterprise plugins? When and how customers can enable/disable their usage? |
||
|
|
||
| - `fusionfs.seqera.io` | ||
| - `fusionfs.seqera.io.cdn.cloudflare.net` | ||
| - `nf-xpack.seqera.io` | ||
| - `nf-xpack.seqera.io.cdn.cloudflare.net` | ||
|
|
||
| #### Wave container services | ||
|
|
||
| Required if using [Wave](https://docs.seqera.io/wave). Compute environments must access `wave.seqera.io` on port 443. If using Wave with the Mirror or Freeze functionality, your container registry must allow the Seqera-hosted Wave service to push images. For the IP addresses from which Wave will push images, see the `egress` section at [https://meta.seqera.io/v3](https://meta.seqera.io/v3). | ||
|
|
||
| - `wave.seqera.io` | ||
| - `community.wave.seqera.io` | ||
|
justinegeffen marked this conversation as resolved.
Outdated
|
||
| - `cerbero.seqera.io` | ||
|
justinegeffen marked this conversation as resolved.
Outdated
|
||
| - `wave-cache-prod-cloudflare.seqera.io` | ||
| - `wave-cache-prod-cloudflare.seqera.io.cdn.cloudflare.net` | ||
|
|
||
| #### Seqera-hosted container registries | ||
|
|
||
| Required if using Seqera-hosted container registries from compute environments. | ||
|
Member
There was a problem hiding this comment. Here we should probably explain/link to the Hub service (comm) and the Studios templates (public) |
||
|
|
||
| - `community.wave.seqera.io` | ||
| - `cerbero.seqera.io` | ||
| - `community-cr-prod.seqera.io` | ||
| - `community-cr-prod.seqera.io.cdn.cloudflare.net` | ||
|
justinegeffen marked this conversation as resolved.
|
||
| - `public.cr.seqera.io` | ||
| - `auth.cr.seqera.io` | ||
| - `public-cr-prod.seqera.io` | ||
| - `public-cr-prod.seqera.io.cdn.cloudflare.net` | ||
|
|
||
| ### Restricting outbound traffic | ||
|
|
||
| If you need to restrict outbound traffic from your Enterprise installation using allowlist-based firewall rules, ensure the services listed in the [Platform requirements](#platform-requirements) and [Compute environment requirements](#compute-environment-requirements) sections remain accessible. Additional services to consider: | ||
|
|
||
| - **Nextflow**: Allow access to `github.com` and GitHub artifacts for Nextflow downloads and updates | ||
| - **Third-party services**: Allow access to any third-party APIs or services your pipelines depend on (consult vendor documentation for specific requirements) | ||
|
|
||
| ## Network requirements summary | ||
|
|
||
| ### Quick reference: Wildcard domains | ||
|
|
||
| For simplified firewall configuration, allowlist the following wildcard domains: | ||
|
|
||
| - `*.seqera.io` | ||
| - `*.seqera.io.cdn.cloudflare.net` | ||
|
|
||
| For IP-based allowlists, see [https://www.cloudflare.com/ips-v4/](https://www.cloudflare.com/ips-v4/) for Cloudflare IP addresses. | ||
|
|
||
| ### Platform instance domains | ||
|
|
||
| | Domain | Port | Required | Purpose | | ||
| | --------------------------- | ---- | -------- | ------------------------------ | | ||
| | `licenses.seqera.io` | 443 | Yes | License validation | | ||
| | `cloudinfo.seqera.io` | 443 | Yes | Cloud resource price prediction | | ||
| | `wave.seqera.io` | 443 | Optional | Wave container services | | ||
| | `community.wave.seqera.io` | 443 | Optional | Wave community services | | ||
| | `cerbero.seqera.io` | 443 | Optional | Wave community authentication | | ||
|
justinegeffen marked this conversation as resolved.
Outdated
|
||
| | `public.cr.seqera.io` | 443 | Optional | Container registry | | ||
| | `auth.cr.seqera.io` | 443 | Optional | Container registry auth | | ||
|
Comment on lines
+148
to
+149
Member
There was a problem hiding this comment. We need to check with Engineering if this CR is used only for Studios template images or something else too |
||
| | `private.cr.seqera.io` | 443 | Optional | Container registry | | ||
|
Member
There was a problem hiding this comment. @munishchouhan @pditommaso what is the
Member
There was a problem hiding this comment. |
||
| | `ai.seqera.io` | 443 | Optional | Co-Scientist | | ||
| | `ai-api.seqera.io` | 443 | Optional | Con-Scientist | | ||
|
justinegeffen marked this conversation as resolved.
Outdated
|
||
| | `mcp.seqera.io` | 443 | Optional | Seqera MCP | | ||
| | `api.multiqc.info` | 443 | Optional | MultiQC reports | | ||
|
justinegeffen marked this conversation as resolved.
Outdated
|
||
|
|
||
| ### Compute environment domains | ||
|
|
||
| | Domain | Port | Required | Purpose | | ||
| | --------------------------------------------------------- | ---- | ----------- | ---------------------------------------------- | | ||
| | `licenses.seqera.io` | 443 | Conditional | License validation (Fusion/Enterprise plugins) | | ||
| | `fusionfs.seqera.io` | 443 | Conditional | Fusion file system | | ||
| | `fusionfs.seqera.io.cdn.cloudflare.net` | 443 | Conditional | Fusion file system (CDN) | | ||
| | `nf-xpack.seqera.io` | 443 | Conditional | Enterprise plugins | | ||
| | `nf-xpack.seqera.io.cdn.cloudflare.net` | 443 | Conditional | Enterprise plugins (CDN) | | ||
| | `wave.seqera.io` | 443 | Conditional | Wave container services | | ||
| | `community.wave.seqera.io` | 443 | Conditional | Wave community services | | ||
|
justinegeffen marked this conversation as resolved.
|
||
| | `cerbero.seqera.io` | 443 | Conditional | Auth service for Community CR | | ||
| | `wave-cache-prod-cloudflare.seqera.io` | 443 | Conditional | Wave cache | | ||
| | `wave-cache-prod-cloudflare.seqera.io.cdn.cloudflare.net` | 443 | Conditional | Wave cache (CDN) | | ||
| | `community-cr-prod.seqera.io` | 443 | Conditional | Container registry | | ||
| | `community-cr-prod.seqera.io.cdn.cloudflare.net` | 443 | Conditional | Container registry (CDN) | | ||
| | `public.cr.seqera.io` | 443 | Conditional | Container registry | | ||
| | `auth.cr.seqera.io` | 443 | Conditional | Container registry authentication | | ||
| | `public-cr-prod.seqera.io` | 443 | Conditional | Container registry | | ||
|
justinegeffen marked this conversation as resolved.
|
||
| | `public-cr-prod.seqera.io.cdn.cloudflare.net` | 443 | Conditional | Container registry (CDN) | | ||
|
|
||
| ### External service requirements | ||
|
|
||
| Both Platform and Compute environments require access to: | ||
|
|
||
| - **Source code hosting providers**: GitHub, GitLab, Bitbucket, Gitea (as configured). Consult your provider's documentation for specific networking requirements and IP allowlists. | ||
| - **Container registries**: Docker Hub, Quay.io, AWS ECR, Azure ACR, Google GCR, or private registries (as configured). Consult your provider's documentation for specific networking requirements and IP allowlists. | ||
| - **Cloud provider APIs**: AWS, Azure, GCP API endpoints (if using cloud compute environments). Consult your cloud provider's documentation for specific networking requirements and service endpoint URLs. | ||
|
|
||
| ## HTTP proxy environment variables | ||
|
|
||
| :::caution | ||
|
gavinelder marked this conversation as resolved.
|
||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.