This calls for a change in the documentation - https://docs.openshift.com/container-platform/4.13/installing/install_config/configuring-firewall.html

Currently this is mentioned in our doc:
"You can use the wildcards *.quay.io and *.openshiftapps.com instead of cdn0[1-3].quay.io in your allowlist."

And cu expectation:
"You can use the wildcards *.quay.io and *.openshiftapps.com instead of cdn.quay.io & cdn0[1-3].quay.io in your allowlist."

This will provide full clarify that one can either choose to whitelist,
> wildcard URLs = *.quay.io and *.openshiftapps.com OR
> non-wildcard URLs = cdn.quay.io & cdn0[1-3].quay.io,