Network Egress & Domains¶
KubeManta is self-hosted and runs entirely inside your own Kubernetes cluster. It reaches a small, well-defined set of external domains — and most of those are optional and only contacted when you turn a feature on. This page lists every domain so your network team can allowlist (or block) them for approval on a corporate/firewalled network.
Minimal footprint
A default install with AI and external integrations left off only needs two domains — api.keygen.sh (licensing) and registry.kubemanta.com (image pulls) — plus api.kubemanta.com for update checks unless you disable them.
Core domains¶
These support licensing, installation, and update checks.
| Domain | Purpose | Required? | When |
|---|---|---|---|
api.keygen.sh |
License validation | Yes (unless running from a cached/offline license) | Periodically at runtime |
registry.kubemanta.com |
Container image + Helm chart pulls | Yes | Install, upgrade, and image pulls |
api.kubemanta.com |
Update-check feed (latest available version) | No — can be disabled | Every 6 hours (cached) |
Disabling the update check
The update check is a convenience, not a requirement. Turn it off in Admin → License (or set UPDATE_CHECK_DEFAULT=false) and KubeManta will never contact api.kubemanta.com. The endpoint it calls is GET https://api.kubemanta.com/version, which returns only the latest published version number — no cluster data is sent.
AI providers (optional)¶
Contacted only when you configure an AI provider and have not enabled local-only mode. Which domain applies depends on the provider you choose. The built-in egress allowlist (Admin → AI Guardrails) is deny-by-default, so nothing is reached until you permit it.
| Provider | Domain |
|---|---|
| Anthropic | api.anthropic.com |
| OpenAI | api.openai.com |
| Google (Gemini) | generativelanguage.googleapis.com, www.googleapis.com |
| Groq | api.groq.com |
| Azure OpenAI | your Azure OpenAI resource endpoint |
| Ollama | your Ollama host (typically in-cluster / local) |
| Custom (OpenAI-compatible) | the base URL you configure |
Keeping cluster data in-network
Set local-only AI (KUBEMANTA_AI_LOCAL_ONLY=true) to forbid any third-party AI provider — pair it with a local Ollama and no cluster data ever leaves your network. See AI Guardrails.
Integrations (optional)¶
Contacted only if you configure the corresponding integration.
| Integration | Domain | Configured in |
|---|---|---|
| Slack alerts | hooks.slack.com (your webhook) |
Alerts → Integrations |
| PagerDuty | events.pagerduty.com |
Alerts → Integrations |
| OpsGenie | api.opsgenie.com |
Alerts → Integrations |
| Datadog | api.datadoghq.com |
Alerts → Integrations |
| Generic webhook | the URL you provide | Alerts → Integrations |
| AWS / GCP / Azure APIs | the cloud provider's API endpoints | Admin → Cloud (for cloud-network topology) |
Not external — in-cluster only¶
These are your own services on your cluster network; KubeManta connects to them over your internal network, not the public internet:
- Prometheus, Grafana, Alertmanager — your monitoring stack (Integrations).
- Trivy self-scan Jobs — run in-cluster; a self-scan pulls its vulnerability database from the container image you configure.
Summary for a firewall request¶
# Always (default install):
api.keygen.sh
registry.kubemanta.com
api.kubemanta.com # optional — omit if update checks are disabled
# Only if you enable AI (and not local-only), the relevant provider host, e.g.:
api.anthropic.com # or api.openai.com / api.groq.com / ...
# Only if you enable alerting/cloud integrations, the relevant host(s), e.g.:
hooks.slack.com / events.pagerduty.com / <your cloud provider APIs>