Restrict access to OpenShift routes by IP address
Page content
In this post I will show you how can restrict access to the routes by source IP address.
Parts of the Openshift series
- Part1: Install Opeshift
- Part2: How to Enable Auto Approval of CSR in Openshift v3.11
- Part3: Add new workers to Openshift cluster
- Part4: Chane the certificates of the Openshift cluster
- Part5: LDAP authentication for Openshift
- Part6: Keycloak SSO authentication for Openshift
- Part7: Gitlab SSO authentication for Openshift
- Part8a: Ceph persistent storage for Openshift
- Part8b: vSphere persistent storage for Openshift
- Part9: Helm on Openshift
- Part10: Tillerless Helm on Openshift
- Part11: Use external docker registry on Openshift
- Part12: Secondary router on Openshift
- Part13a: Use Letsencrypt on Openshift
- Part13b: Install cert-managger on Openshift
- Part14: Create Openshift operators
- Part15: Convert docker-compose file to Opeshift
- Part16a: Opeshift elasticsearch search-guard error
- Part16b: Openshift: Log4Shell - Remote Code Execution (CVE-2021-44228) (CVE-2021-4104)
Restricting access to a route
After creating and exposing a route, you can add an annotation to the route specifying the IP address(es) that you would like to whitelist. Whitelisting a IP address automatically blacklists everything else.
oc annotate route test-route haproxy.router.openshift.io/ip_whitelist=192.168.0.0/24
To allow several IP addresses through to the route, separate each IP with a space:
oc annotate route test-route haproxy.router.openshift.io/ip_whitelist=192.168.1.10 180.5.61.153 192.168.1.0/24 192.168.0.0/24
To delete the IPs from the annotation, you can run the command:
oc annotate route test-route haproxy.router.openshift.io/ip_whitelist-
