When a LaunchPad is deployed into a customer's network - either on a dedicated Operation Technology "OT" or within the normal IT network - there are some resources the applications and operating system need to communicate with for full functionality. The list is provided at the end of the article. However, let's touch on what that LP is actually doing that requires these connections.
The Noda LaunchPad is a multi-faceted software suite loaded onto provided hardware or setup virtually on existing VM infrastructure. To sum up the most important components, let's break down 3 foundational product features the LP facilitates:
LAN Connectivity: Utilize SkySpark "at the edge" to talk to building equipment and devices over the local network.
Cloud Connectivity: Leverage the Operating System and SkySpark application to allow remote monitoring and patching of the software running on the virtual machine or Noda provided hardware.
Application Host: The architecture of the LP is such that it avoids common pitfalls of cloud services, by running the primary application - SkySpark - on the VM or hardware itself, reducing the need for devices or applications to constantly talk to Noda's AWS Cloud.
The LaunchPad is architected to support modern cyber security infrastructure by not requiring inbound firewall access. However, to ensure connectivity to the Noda user interface, support remote OS patch management and application updates, there is a need for outbound connectivity.
Wildcard Domains
Listed below are wildcard domains that the device must have permission to connect to:
https://*.amazonaws.com
https://*.noda.ai
https://gitlab.com
https://*.gitlab.com
https://*.gitlab-static.net
https://insights-collector.cell.nr-data.net
https://insights-collector.newrelic.com
https://*.docker.com
https://*.skyfoundry.com
http://*.ubuntu.com
smtp://smtp.mailgun.org:465
This list is less specific and lists the top level domains. If required, a more granular list with specific subdomains is provided further below. Each domain is listed with the required protocol (most are https).
Note that most IPs associated with these services are dynamic and/or region specific. If access can only be provided by IP address please reach out to Noda for help.
Subdomains
As an alternative to the list above, if more specific subdomains are required, refer to the list below:
https://ssm.us-west-2.amazonaws.com
https://ssmmessages.us-west-2.amazonaws.com
https://ec2messages.us-west-2.amazonaws.com
https://*.s3.us-west-2.amazonaws.com
https://*.s3.amazonaws.com
https://energy.noda.ai
https://connect.noda.ai
https://api.connect.noda.ai
https://oap.connect.noda.ai
https://oap.connect.noda.ai/api
https://auth.energy.noda.ai
https://skyspark-routing.energy.noda.ai
https://skyspark-admin.energy.noda.ai
https://gitlab.com
https://*.gitlab.com
https://*.gitlab-static.net
https://insights-collector.cell.nr-data.net
https://insights-collector.newrelic.com
https://download.docker.com
https://*.download.docker.com
https://*.skyfoundry.com
http://*.archive.ubuntu.com
smtp://smtp.mailgun.org:465
ntp.ubuntu.com
Note: If a network team is using IPs to whitelist our outbound connections, it’s pertinent to note the GitLab URLs are fronted by Cloudflare, and those IPs are listed at https://www.cloudflare.com/ips-v4/