Adding IP restrictions on an OVHcloud Managed Private Registry

Objective

The OVHcloud Managed Private Registry service, a cloud-native registry built on Harbor, allows you to store, manage and access your container images (OCI artifacts) and Helm charts.

This guide will cover the feature that allows you to manage access to the HMI of your OVHcloud Managed Private Registry and to the registry itself. Thanks to that you can add IP restrictions in a cluster.

Requirements

• A Public Cloud project in your OVHcloud account
• An OVHcloud Managed Private Registry (see the creating a private registry guide for more information)

OVHcloud Console Access

• Direct link: Projects
• Navigation path: Public Cloud > Select your project > Containers > Managed Private Registry

Instructions

The IP restrictions feature allows you to add whitelisted IP for two parts of the OVHcloud Managed Private Registry:

• /management -> HMI/Harbor user interface
• /registry -> Client/CLI side: docker login/pull/push, helm...

This means that you can configure different IP blocks (CIDR) for the HMI and the registry part, depending on your teams, environments, needs...

Adding IP restrictions through the OVHcloud Console

In your Public Cloud project, click Managed Private Registry under Containers in the left-hand menu, click the name of your registry, then open the Security tab.

Click Add IP restriction. In the form that appears:

• IP block (CIDR): enter a single IPv4 address or a network in CIDR notation. An address without a prefix is saved as /32.
• Description: optionally, describe the rule.
• Type: choose Management (Harbor user interface and API), Registry (pulling and pushing images) or Management + Registry.

Click Save. Repeat the operation to add other IP blocks.

To change or remove a rule, click the ... button on its row and select Edit or Delete.

Adding IP restrictions through the API

The API Explorer

To simplify things, we are using the API Explorer which allows to explore, learn and interact with the API in an interactive way.

If you go to the Container Registry section of the API Explorer, you will see the available endpoints, such as:

API endpoints

• Get an existing IP restriction on management endpoint:

Result:

[
  {
    "createdAt": "2024-01-10T09:53:28.839586Z",
    "description": "string",
    "ipBlock": "192.0.2.0/24",
    "updatedAt": "2024-01-10T09:53:28.839586Z"
  }
]

• Add or update an IP restriction on management endpoint:

[
  {
    "description": "production environment",
    "ipBlock": "192.0.2.0/24"
  }
]

Result:

[
  {
    "createdAt": "2024-02-01T15:15:06.436256Z",
    "description": "production environment",
    "ipBlock": "192.0.2.0/24",
    "updatedAt": "2024-02-01T15:15:06.436256Z"
  }
]

After adding IP restrictions for the management endpoint, an unauthorized IP will have an "UNAUTHENTICATED" error message on the Harbor user interface:

• Get an existing IP restriction on registry endpoint:

Result:

[]

• Add or update an IP restriction on registry endpoint:

[
  {
    "description": "Q/A environment",
    "ipBlock": "192.0.1.0/24"
  }
]

Result:

[
  {
    "createdAt": "2024-02-01T15:18:05.611221Z",
    "description": "Q/A environment",
    "ipBlock": "192.0.1.0/24",
    "updatedAt": "2024-02-01T15:18:05.611221Z"
  }
]

After adding IP restrictions for the registry endpoint, an unauthorized IP will have an error message:

• For Docker CLI:

$ docker pull xxxxx.c1.gra9.container.registry.ovh.net/library/ubuntu:10.04
Error response from daemon: error parsing HTTP 403 response body: Invalid character '<' looking for begining of value...

• For Helm CLI:

$ helm registry login xxxxx.c1.gra9.container.registry.ovh.net
Username: xxx
Password:
Error: login attempt to https://xxxxx.c1.gra9.container.registry.ovh.net/v2/ failed with status: 403 Forbidden

Go further

To have an overview of OVHcloud Managed Private Registry service, read the OVHcloud Managed Private Registry documentation.

For training or technical assistance implementing our solutions, contact your sales representative or visit our Professional Services page to request a quote and have your project analysed by our experts.

• Join our community of users.