Merge pull request #218 from bcgov/AI-1341

Rename ip_whitelist annotation to ip_allowlist

Author: kmandryk

deployments/openshift/kustomize/base/backend-services/route.yml

@@ -17,7 +17,7 @@ metadata:
     # Gold DR:  142.34.64.6–9      (NAT pool egress IPs)
     # Emerald:  no fixed egress IPs — each namespace has a dedicated /26 private range;
     #           add your namespace's /26 CIDR here if cross-cluster access from Emerald is needed.
-    haproxy.router.openshift.io/ip_whitelist: >-
+    haproxy.router.openshift.io/ip_allowlist: >-
       142.16.0.0/11
       142.34.194.121 142.34.194.122 142.34.194.123 142.34.194.124
       142.34.229.6 142.34.229.7 142.34.229.8 142.34.229.9

deployments/openshift/kustomize/base/frontend/route.yml

@@ -12,7 +12,7 @@ metadata:
     # Gold DR:  142.34.64.6–9      (NAT pool egress IPs)
     # Emerald:  no fixed egress IPs — each namespace has a dedicated /26 private range;
     #           add your namespace's /26 CIDR here if cross-cluster access from Emerald is needed.
-    haproxy.router.openshift.io/ip_whitelist: >-
+    haproxy.router.openshift.io/ip_allowlist: >-
       142.16.0.0/11
       142.34.194.121 142.34.194.122 142.34.194.123 142.34.194.124
       142.34.229.6 142.34.229.7 142.34.229.8 142.34.229.9

deployments/openshift/kustomize/overlays/prod/kustomization.yml

@@ -8,11 +8,11 @@ patches:
   target:
     kind: ConfigMap
     name: backend-services-config
-- path: route-whitelist-patch.yml
+- path: route-allowlist-patch.yml
   target:
     kind: Route
     name: backend-services
-- path: route-whitelist-patch.yml
+- path: route-allowlist-patch.yml
   target:
     kind: Route
     name: frontend

…/overlays/prod/route-whitelist-patch.yml …/overlays/prod/route-allowlist-patch.ymldeployments/openshift/kustomize/overlays/prod/route-whitelist-patch.yml renamed to deployments/openshift/kustomize/overlays/prod/route-allowlist-patch.yml deployments/openshift/kustomize/overlays/prod/route-whitelist-patch.yml renamed to deployments/openshift/kustomize/overlays/prod/route-allowlist-patch.yml

@@ -1,3 +1,3 @@
 - op: replace
-  path: /metadata/annotations/haproxy.router.openshift.io~1ip_whitelist
+  path: /metadata/annotations/haproxy.router.openshift.io~1ip_allowlist
   value: 142.22.0.0/16 142.23.0.0/16 142.24.0.0/16 142.25.0.0/16 142.26.0.0/16 142.27.0.0/16 142.28.0.0/16 142.29.0.0/16 142.30.0.0/16 142.31.0.0/16 142.32.0.0/16 142.33.0.0/16 142.34.0.0/16 142.35.0.0/16 142.36.0.0/16

deployments/openshift/kustomize/overlays/test/kustomization.yml

@@ -8,11 +8,11 @@ patches:
   target:
     kind: ConfigMap
     name: backend-services-config
-- path: route-whitelist-patch.yml
+- path: route-allowlist-patch.yml
   target:
     kind: Route
     name: backend-services
-- path: route-whitelist-patch.yml
+- path: route-allowlist-patch.yml
   target:
     kind: Route
     name: frontend

…/overlays/test/route-whitelist-patch.yml …/overlays/test/route-allowlist-patch.ymldeployments/openshift/kustomize/overlays/test/route-whitelist-patch.yml renamed to deployments/openshift/kustomize/overlays/test/route-allowlist-patch.yml deployments/openshift/kustomize/overlays/test/route-whitelist-patch.yml renamed to deployments/openshift/kustomize/overlays/test/route-allowlist-patch.yml

@@ -1,3 +1,3 @@
 - op: replace
-  path: /metadata/annotations/haproxy.router.openshift.io~1ip_whitelist
+  path: /metadata/annotations/haproxy.router.openshift.io~1ip_allowlist
   value: 142.22.0.0/16 142.23.0.0/16 142.24.0.0/16 142.25.0.0/16 142.26.0.0/16 142.27.0.0/16 142.28.0.0/16 142.29.0.0/16 142.30.0.0/16 142.31.0.0/16 142.32.0.0/16 142.33.0.0/16 142.34.0.0/16 142.35.0.0/16 142.36.0.0/16

docs-md/openshift-deployment/KUSTOMIZE_INSTANCE_TEMPLATE.md

@@ -33,7 +33,7 @@ The template uses placeholder tokens that the deploy script replaces with actual
 
 ### Route IP restrictions
 
-Base `Route` manifests under `deployments/openshift/kustomize/base/` set `haproxy.router.openshift.io/ip_whitelist` so the OpenShift router (HAProxy) only allows traffic whose source IP is in `142.16.0.0/11` (approximate VPN range). Other clients receive HTTP 403 at the router. The backend Route also keeps `haproxy.router.openshift.io/deny-list` for `/metrics` (see `docs-md/PROMETHEUS_METRICS.md`). Multiple CIDRs or IPs use a space-separated annotation value if needed later.
+Base `Route` manifests under `deployments/openshift/kustomize/base/` set `haproxy.router.openshift.io/ip_allowlist` so the OpenShift router (HAProxy) only allows traffic whose source IP is in `142.16.0.0/11` (approximate VPN range). Other clients receive HTTP 403 at the router. The backend Route also keeps `haproxy.router.openshift.io/deny-list` for `/metrics` (see `docs-md/PROMETHEUS_METRICS.md`). Multiple CIDRs or IPs use a space-separated annotation value if needed later.
 
 ### What Gets Patched