---
name: openshift-ts-ip-whitelist-annotation
title: Why can't I use the Red Hat annotations to restrict access to the Red Hat OpenShift Console?
description: '[Virtual Private Cloud] [Classic infrastructure]'
last-updated: 2026-05-04
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/openshift?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Why can't I use the Red Hat annotations to restrict access to the Red Hat OpenShift Console?
{: #ip_whitelist}
{: troubleshoot}
{: support}

[Virtual Private Cloud]{: tag-vpc} [Classic infrastructure]{: tag-classic-inf}

When you use the Red Hat `ip_whitelist` allowlist annotation to allow only certain source IP addresses to access the Red Hat OpenShift console, it does not work as expected.
{: tsSymptoms}

By default, the source IP address is not preserved from the client (console web browser) through the load balancer and to the router pod. Because the source IP address isn't available when the filtering is done in the router pod, you can't use the `ip_whitelist` annotation to allow certain IP addresses to access the console.
{: tsCauses}

Do not use the Red Hat `ip_whitelist` annotation to restrict Red Hat OpenShift console access to specific IP addresses or IP address ranges. Instead, use context-based restrictions (CBR) for this purpose.
{: tsResolve}

For more information, see [Allowing Red Hat OpenShift on IBM Cloud to access other IBM Cloud resources by using CBR](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=ui&format=markdown#cbr-integrations).