Description

Ensure each Managed Private Registry has IP restrictions on both its management interface (the Harbor UI and API) and its registry endpoint, so only approved networks can manage the registry or push and pull images.

Rationale

Container registries store the images that run in production. If they are reachable from anywhere, attackers can try to log in, steal images that may contain secrets, or push tampered images. IP restrictions limit access to known networks such as CI/CD runners and clusters.

Impact

  • Only approved networks can access the registry

  • Reduces the risk of image theft or tampering

  • New clusters and CI runners must be added to the list

Default Value

By default, no IP restrictions are set, and the registry is reachable from any IP address.

Pre-Requisites

  • Permission to manage the registry

  • A list of IP ranges that need access

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Managed Private Registry and open the registry.

  4. Check the IP restrictions for the management interface and the registry endpoint.

  5. Alternatively, use the OVHcloud API console at https://eu.api.ovh.com/console/ (or your region's console). Run GET /cloud/project/{serviceName}/containerRegistry/{registryID}/ipRestrictions/management and .../ipRestrictions/registry.

  6. If either has no restrictions, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. Open the registry and add the approved IP ranges to the management and registry IP restrictions.

  4. Alternatively, run PUT /cloud/project/{serviceName}/containerRegistry/{registryID}/ipRestrictions/management and .../ipRestrictions/registry with the list of ranges.

  5. Confirm that your clusters and CI runners can still pull and push images.

Backout Plan

  1. Run the same PUT requests with an empty list, or remove the restrictions in the Control Panel.

Reference