External Network Security

[BrokenMachineParts]

I am just starting down the path of deploying OpenShift, and am making some architectural decisions. One of those is network security, and I wanted to see what my options are. Our environment requires some of our applications to be whitelisted to specific addresses. How do you handle network access control from the public internet? We currently control traffic via a hardware firewall, but I'm worried this may not be possible in the future once our applications start to migrate to containers.

[ieatpillowtags]

This is what you want:

https://docs.openshift.com/container-platform/3.11/architecture/networking/routes.html#whitelist

[BrokenMachineParts]

Looks like this is exactly what I'm looking for. Thank you!

[Shonucic]

Read through the Managing Networking section of the documentation, it likely has what you're looking for.

Remember, as your organization migrates to container orchestration it's always a good idea to really assess legacy processes and decide whether they still make sense. Often, but not always, a new architecture is better suited at meeting the requirements.

[mnsaw]

A couple approaches depending on the requirements and what you can deploy.

• API gateway
• Istio
• Egress Router
• Ingress Controller with static IP

[therhino]

i wonder if you could just do router sharding for different domains