anchor.diff:  | *53*
   |Provides DNS services.
   
  +| *2049*
  +|Required when provisioning an NFS host as part of the installer.
  +
   | *2379*
   |Used for standalone etcd (clustered) to accept changes in state.
   
  
positive.code: 
  | *4789*
  |Required for SDN communication between pods on separate hosts.
  
  
  |===
  
negative.code: SELINUXTYPE=targeted
  ----
  
  [[prereq-cloud-provider-considerations]]
  
  === Cloud Provider Considerations
  
  *Set up the Security Group*
  
  When installing on AWS or OpenStack, ensure that you set up the appropriate
  security groups. These are some ports that you should have in your security
  groups, without which the installation will fail. You may need more depending on
  the cluster configuration you want to install. For more information and to
  adjust your security groups accordingly, see link:#required-ports[Required Ports]
  for more information.
  
  
  [cols="1,2"]
  |===
  |*All OpenShift Hosts*
  a|tcp/22 from host running the installer/Ansible
  
  |*etcd Security Group*
  a| - tcp/2379 from masters
  - tcp/2380 from etcd hosts
  
  |*Master Security Group*
  a| - tcp/8443 from 0.0.0.0/0
  - tcp/53 from all OpenShift hosts
  - udp/53 from all OpenShift hosts
  
  |*Node Security Group*
  a| - tcp/10250 from masters
  - tcp/4789 from nodes
  
  |*Infrastructure Nodes*
  (ones that can host the `*openshift-router*`)
  a|- tcp/443 from 0.0.0.0/0
  - tcp/80 from 0.0.0.0/0
  
  |===
  
  If configuring ELBs for load balancing the masters and/or routers, you also need
  to configure Ingress and Egress security groups for the ELBs appropriately.
  
  *Override Detected IP Addresses and Host Names*
  
  Some deployments require that the user override the detected host names and IP
  addresses for the hosts. To see the default values, run the `*openshift_facts*`
  playbook:
  
  ====
  ----
  # ansible-playbook playbooks/byo/openshift_facts.yml
  ----
  ====
  
  Now, verify the detected common settings. If they are not what you expect them
  to be, you can override them.
  
  The link:../install_config/install/advanced_install.html#configuring-ansible[Advanced Installation] topic discusses the available Ansible variables in greater detail.
  
  [cols="1,2"]
  |===
  |`*hostname*`
  a| - Should resolve to the internal IP from the instances themselves.
  - `*openshift_hostname*` overrides.
  
  |`*ip*`
  a| - Should be the internal IP of the instance.
  - `*openshift_ip*` will overrides.
  
  |`*public_hostname*`
  a| - Should resolve to the external IP from hosts outside of the cloud.
  - Provider `*openshift_public_hostname*` overrides.
  
  |`*public_ip*`
  a| - Should be the externally accessible IP associated with the instance.
  - `*openshift_public_ip*` overrides.
  
  |`*use_openshift_sdn*`
  a| - Should be true unless the cloud is GCE.
  - `*openshift_use_openshift_sdn*` overrides.
  
  |===
  
  [WARNING]
  ====
  If `*openshift_hostname*` is set to a value other than the metadata-provided
  `*private-dns-name*` value, the native cloud integration for those providers
  will no longer work.
  ====
  
  In AWS, situations that require overriding the variables include:
  
  [cols="1,2"]
  |===
  |`*hostname*`
  a|The user is installing in a VPC that is not configured for both `*DNS hostnames*` and `*DNS resolution*`.
  
  |`*ip*`
  a|Possibly if they have multiple network interfaces configured and they want to
  use one other than the default. You must first set
  `*openshift_node_set_node_ip*` to `True`. Otherwise, the SDN would attempt to
  use the `*hostname*` setting or try to resolve the host name for the IP.
  
  |`*public_hostname*`
  a| - A master instance where the VPC subnet is not configured for `*Auto-assign
  Public IP*`. For external access to this master, you need to have an ELB or
  other load balancer configured that would provide the external access needed, or
  you need to connect over a VPN connection to the internal name of the host.
  - A master instance where metadata is disabled.
  - This value is not actually used by the nodes.
  
  |`*public_ip*`
  a| - A master instance where the VPC subnet is not configured for `*Auto-assign Public IP*`.
  - A master instance where metadata is disabled.
  - This value is not actually used by the nodes.
  
  |===
  
  If setting `*openshift_hostname*` to something other than the metadata-provided
  `*private-dns-name*` value, the native cloud integration for those providers
  will no longer work.
  
  For EC2 hosts in particular, they must be deployed in a VPC that has both
  `*DNS host names*` and `*DNS resolution*` enabled, and `*openshift_hostname*`
  should not be overridden.
  
  *Post-Installation Configuration for Cloud Providers*
  
  Following the installation process, you can configure OpenShift for
  link:../install_config/configuring_aws.html[AWS],
  link:../install_config/configuring_openstack.html[OpenStack], or
  link:../install_config/configuring_gce.html[GCE].
  
  [[host-preparation]]
  
  == Host Preparation
  