Skip to content

Configure IP Access

This page describes how to configure the ip_allowlist setting in the Hydrolix configuration. This setting controls access to network services running on Hydrolix.

Each new Hydrolix cluster blocks inbound network access by default.

The ip_allowlist limits access to all services, such as the Query Interfaces and HTTP Stream API.

Effects of IP access controls⚓︎

When the default ip_allowlist, 0.0.0.0/0 is in use, the cluster

  • allows any client IP to reach your cluster's service IP.
  • interoperates smoothly with automatic HTTP challenge-response validation for ACME-provisioned certificates from multiple vantage points on the Internet.

When using a stricter ip_allowlist, the cluster

  • allows connections initiated from IP addresses or networks listed in CIDR format in the ip_allowlist.
  • forbids connections from all other clients.
  • doesn't work smoothly with ACME HTTP challenge-response validation.

If using a non-default ip_allowlist, use the Kubernetes cert-manager software and the DNS challenge or provision certificates manually.

Changing the IP access control list has no effect on higher-layer authentication and authorization requirements. Clients must still authenticate or present valid authorization tokens.

For finer control that restricts access at the Traefik proxy layer, see Configure the Traefik IP Allowlist.

Example Hydrolix spec fragments⚓︎

The operator software reconfigures the traefik reverse proxy when the ip_allowlist changes.

Public cluster⚓︎

To allow access from any address, use the IPv4 default route 0.0.0.0/0 in the ip_allowlist field of your Hydrolix configuration.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
apiVersion: hydrolix.io/v1
kind: HydrolixCluster
metadata:
  name: hydrolix
  namespace: hydrolix
spec:
  admin_email: admin@email.com
  db_bucket_url: gs://hydrolix-demo
  env: {}
  hydrolix_url: https://hostname.hydrolix.live
  ip_allowlist:
  - 0.0.0.0/0
  overcommit: false
  scale: {}
  scale_profile: minimal

Limited access cluster⚓︎

To constrain access to a specific set of IPv4 addresses or network prefixes, list them in the ip_allowlist field of your Hydrolix configuration.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
apiVersion: hydrolix.io/v1
kind: HydrolixCluster
metadata:
  name: hydrolix
  namespace: hydrolix
spec:
  admin_email: admin@email.com
  basic_auth:
  - version
  db_bucket_url: gs://hydrolix-demo
  env: {}
  hydrolix_url: https://hostname.hydrolix.live
  ip_allowlist:
  - 23.235.32.0/20
  - 43.249.72.0/22
  - 103.244.50.0/24
  overcommit: false
  scale: {}
  scale_profile: minimal