Skip to main content

Akuity Platform Networking Requirements

Egress Traffic Rules​

  • Allow port 443 (TCP) for secure HTTPS and TCP communication.

Domain Access​

The following domains need to be configured and allowlisted for access :

US Region​

  • akuity.cloud
  • *.cd.akuity.cloud
  • *.cdsvcs.akuity.cloud
  • *.kargo.akuity.cloud
  • *.kargosvcs.akuity.cloud

EU Region​

  • eu.akuity.cloud
  • *.cd.eu.akuity.cloud
  • *.cdsvcs.eu.akuity.cloud
  • *.kargo.eu.akuity.cloud
  • *.kargosvcs.eu.akuity.cloud

IP Allowlisting​

Akuity Platform IPs​

If your workload cluster restricts egress traffic by IP, add the following Akuity Platform addresses to your cluster's allow list so that the Akuity Platform Agent can reach the Akuity Platform:

US Region :​
35.83.167.172
35.164.149.26
44.227.111.216
13.248.239.50
166.117.206.69
EU Region :​
63.180.120.65
3.74.238.191
63.180.42.11
166.117.35.43
99.83.186.100

Outbound IPs for External Service Allowlisting​

When Akuity Platform components on the controlplane (one notable example is when an app-of-apps is used) connects to your external services (such as Git repositories, container registries, or other endpoints), its outbound traffic originates from the following IP addresses. If your external service restricts access by IP — for example, when using GitHub App IP allow lists — add these addresses to permit access:

US Region:​

Primary:

52.40.235.49
35.85.123.223
52.32.37.241

Secondary:

3.131.212.153
3.23.166.188
3.151.25.1
EU Region:​

Primary:

63.177.220.72
3.68.60.214
3.120.93.7

Secondary:

108.129.16.112
52.210.252.235
34.251.181.211

Add both the primary and secondary addresses for your region, so that access keeps working if the control plane fails over.

Amazon S3 Buckets​

When the control plane reaches an Amazon S3 bucket in the AWS region it runs in, the request goes through a VPC endpoint instead of the outbound IPs above, so an aws:SourceIp condition does not match it. If your bucket restricts access by IP, also allow the VPC endpoints for your Akuity region with aws:SourceVpce:

Akuity regionVPC endpoint IDs
USvpce-0233d284fbda6f264, vpce-059a14155c3a7431e
EUvpce-0f99c1e22710902ce, vpce-00b4eae792fa95b06

Put both keys in the same condition block of a Deny statement. Conditions in one block must all match, so the request is denied only when it comes from neither the outbound IPs nor the endpoints. For the US region:

"Condition": {
  "NotIpAddress": {
    "aws:SourceIp": [
      "52.40.235.49/32", "35.85.123.223/32", "52.32.37.241/32",
      "3.131.212.153/32", "3.23.166.188/32", "3.151.25.1/32"
    ]
  },
  "StringNotEquals": {
    "aws:SourceVpce": ["vpce-0233d284fbda6f264", "vpce-059a14155c3a7431e"]
  }
}

An allowlist based on IP addresses or endpoints admits every workload on the Akuity Platform control plane, so use it together with credentials, not instead of them.

Cloudflare IPs​

The Akuity Platform uses Cloudflare as a sub-processor to provide CDN and security services. Cloudflare only processes limited network-level metadata (IP addresses and HTTP request data) and does not access or retain customer application data, credentials, or stored content. Cloudflare is compliant with ISO 27001, SOC 2 Type II, PCI-DSS, GDPR, and other leading security standards.

When accessing resources behind IP allowlists (such as private Git repositories or artifact registries), you must add Cloudflare's IP ranges to your allowlist. This ensures that traffic from the Akuity Platform, which routes through Cloudflare, can successfully reach your protected resources.

Cloudflare IP Ranges

For more information about Akuity's sub-processors, see the Sub-Processor list.