Guides
  1. Introducing Cast AI
  2. Platform permissions & data privacy

Communication requirements

Traffic and communication requirements of Cast AI.

This guide explains the network requirements for Cast AI components to communicate with our services.

Required endpoints

Core services

All Cast AI components must be able to reach these endpoints:

US region

  • api.cast.ai:443
  • grpc.cast.ai:443 (Pod pinner only)
  • kvisor.prod-master.cast.ai:443 (Kvisor)
  • files.cast.ai:443

EU region

  • api.eu.cast.ai:443
  • grpc.eu.cast.ai:443 (Pod pinner only)
  • kvisor.prod-eu.cast.ai:443 (Kvisor)
  • files.eu.cast.ai:443

India region

  • api.india.cast.ai:443
  • grpc.india.cast.ai:443 (Pod pinner only)
  • api-grpc.india.cast.ai:443 (Kvisor, APA, and newer components)
  • files.india.cast.ai:443

Supporting services

Cast AI also requires access to these endpoints:

  • Container registries (ghcr.io:443 covers GHCR token and image-blob requests):

    RegistryHostImage repositoryRole
    GitHub Container Registryghcr.io:443ghcr.io/castai/imagesDefault
    Google Artifact Registryus-docker.pkg.dev:443us-docker.pkg.dev/castai-hub/libraryFallback

    Both registries host the same images at the same repository path; append /<image>.

  • Helm charts:

    • castai.github.io:443
    • objects.githubusercontent.com:443
    • release-assets.githubusercontent.com:443

  • Node binaries: storage.googleapis.com/castai-node-components/

  • Node logs: storage.googleapis.com/castai-node-logs-sender/

The files.*.cast.ai URLs listed under Core services represent static IP proxies for node binaries and node logs.

Image registry override

In the castai umbrella chart, each component selects its image through image.repository, at autoscaler.<component>.image.repository. To route a component to the fallback registry, point that value at the fallback path. Only the registry host changes; the image path is identical. For example, on the agent and Kvisor:

autoscaler:
  castai-agent:
    image:
      repository: us-docker.pkg.dev/castai-hub/library/agent
  castai-kvisor:
    image:
      repository: us-docker.pkg.dev/castai-hub/library/kvisor

Components not overridden keep their default (GHCR) repository.

Port requirements

Webhook ports

Some Cast AI components operate as admission webhooks and require the Kubernetes API server to reach them on specific ports:

For webhook functionality to work properly, these ports must be accessible from the Kubernetes control plane to the Cast AI pods.

Node startup logs upload

During node initialization, Cast AI uploads startup logs to assist with troubleshooting and cluster setup. This process uses a scoped-down, temporary API key with the following characteristics:

  • Scope: The API key provides read-only access and is restricted to log ingestion only
  • Lifecycle: A unique key is generated per node and is automatically deleted when the node is terminated
  • Usage: Used for up to 1 hour after the initialization AddNode operation to send logs to storage.googleapis.com/castai-node-logs-sender/
  • Expiration: The API key automatically expires 1 hour after creation (node add operation initiation)
  • Security: The API key is not reused across nodes and does not grant access to other API functionalities

The API key appears in EC2 User Data during node startup, but it cannot be used in any other way or for any other purpose.

Network configuration

IP allowlisting

If DNS allowlisting is not possible in your network infrastructure (firewall, NAT, Security Group, etc.), you can allowlist the IPs below instead.

These are the static IPs of the Cast AI API endpoints. Your components initiate outbound connections to them to deliver information to the Cast AI SaaS. Within a region, the API, gRPC, and files endpoints share the same set.

US region

  • 104.16.81.56
  • 104.16.82.56

EU region

  • 141.101.90.96
  • 141.101.90.97
  • 141.101.90.98
  • 141.101.90.99

India region

  • 172.65.90.8
  • 172.65.90.9
  • 172.65.90.10
  • 172.65.90.11
📘

Note

To limit which source IP addresses can access the Cast AI platform, API, and console, see IP-Based Access Control.

Proxy configuration

To use Cast AI components behind a proxy, add these environment variables to your deployments:

env:
- name: HTTP_PROXY
  value: "http://<proxy-address>:<port>"
- name: HTTPS_PROXY
  value: "https://<proxy-address>:<port>"
- name: NO_PROXY
  value: "localhost,<pod-cidr>,<svc-cidr>,*.cluster.local,googleapis.com,metadata.google.internal"

Example manifest for the castai-agent deployment on a GKE cluster:

containers:
- env:
  - name: API_URL
    value: $CASTAI_API_URL  # Replace with your regional API URL. See API access doc for regional endpoints.
  - name: PROVIDER
    value: gke
  - name: MONITOR_METADATA
    value: /agent-metadata/metadata
  - name: PPROF_PORT
    value: "6060"
  - name: HTTP_PROXY
    value: "http://<proxy-address>:<port>"
  - name: HTTPS_PROXY
    value: "https://<proxy-address>:<port>"
  - name: NO_PROXY
    value: "localhost,<pod-cidr>,<svc-cidr>,*.cluster.local,googleapis.com,metadata.google.internal"
  envFrom:
  - secretRef:
      name: castai-agent
  image: ghcr.io/castai/images/agent:v0.48.1
📘

Note

Configure NO_PROXY to match your environment to prevent internal Kubernetes traffic from being sent to the external proxy.

⚠️

TLS-intercepting (MITM) proxies

If your proxy intercepts TLS traffic, it re-signs certificates with its own CA. Cast AI components must trust that CA or their outbound calls fail TLS verification. Configure a custom CA certificate for both layers:

Cast AI egress IPs

Cast AI services use these IP addresses to communicate with third-party services and cloud providers (for example, when managing your cluster resources). If your infrastructure restricts such traffic, allowlist these IPs.

US region (prod-master)

  • 34.48.199.96
  • 35.221.25.73
  • 34.48.86.252
  • 34.86.37.231

EU region (prod-eu)

  • 34.141.71.171
  • 34.89.180.238
  • 35.246.207.216
  • 34.89.186.65

India region (prod-india)

  • 34.14.155.44
  • 34.47.196.217
  • 35.200.215.233
  • 34.100.217.237

GKE with Istio requirements

When using Istio on GKE, configure your cluster with:

  • Port 15017 in firewall_inbound_ports
  • add_master_webhook_firewall_rules set to true

Example Terraform configuration:

add_master_webhook_firewall_rules = true
firewall_inbound_ports            = ["15017"]

Updated 3 days ago

Did this page help you?