---
name: satellite-link-endpoint-secure
title: Accessing your Red Hat OpenShift API Satellite link endpoints
description: By default, Red Hat OpenShift on IBM Cloud API link endpoints accept traffic only from the IBM Cloud control plane. Configure an ACL to allow access from other sources.
last-updated: 2026-08-27
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/satellite?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Accessing your Red Hat OpenShift API Satellite link endpoints
{: #link-endpoint-secure}

By default, Red Hat OpenShift on IBM Cloud API link endpoints accept traffic only from the IBM Cloud control plane. Configure an ACL to allow access from other sources.
{: shortdesc}

You can configure the ACL for your endpoint by following the instructions in [creating access control lists by using the console](https://cloud.ibm.com/docs/satellite?topic=satellite-link-cloud-create&interface=ui&format=markdown#link-sources-ui) or by running the following CLI command.

```sh
ibmcloud sat acl create --name NAME --location LOCATION --endpoint ENDPOINT --subnet SUBNET [--subnet SUBNET ...]
```
{: pre}

To find the Red Hat OpenShift API endpoint in your Satellite location, run `ibmcloud sat endpoints --location LOCATION` and look in the output for the endpoint with a name that starts with `openshift-api-`.
{: tip}

The subnets that your ACL needs to allow depend on where you are trying to access the API server from, for example, where you are trying to run `kubectl` commands from. The actual source IP that is calling the endpoint is not always the IP you expect, especially if your source is coming from a Kubernetes cluster or instance in VPC.

Use one of the following instructions, depending on your environment.

* **If you are running in VPC**, you can find your source IPs using the following command.

    ```sh
    ibmcloud is vpc VPC
    ```
    {: pre}

    Look for the `Cloud Service Endpoint source IP addresses` section in the output. For example:

    ```txt
    Cloud Service Endpoint source IP addresses:    Zone         Address
                                                   us-south-1   10.22.13.83
                                                   us-south-2   10.12.158.57
                                                   us-south-3   10.12.164.28
    ```
    {: screen}

    Use the Cloud Service Endpoint source IPs to configure your ACL. For example:

    ```sh
    ibmcloud sat acl create --name myOpenShiftACL --location myLocation --endpoint openshift-api-cqv7rh4w0pf9mjcsacd0 --subnet 10.22.13.83 --subnet 10.12.158.57 --subnet 10.12.164.28
    ```
    {: pre}

* **If you are using a classic VM**, run the following command to find the IP of your virtual service instance.

    ```sh
    ibmcloud sl vs list
    ```
    {: pre}

    Example output:

    ```txt
    id          hostname      domain                          cpu   memory   public_ip        private_ip       datacenter   action
    146349551   myhost        mydomain.ibmcloud.private       1     2048     169.48.27.170    10.166.165.5     tor01
    ```
    {: screen}

    Use the `private_ip` of your virtual service instance to configure your ACL. For example:

    ```sh
    ibmcloud sat acl create --name myOpenShiftACL --location myLocation --endpoint openshift-api-cqv7rh4w0pf9mjcsacd0 --subnet 10.166.165.5
    ```
    {: pre}

* **In all other cases**, you can find the Red Hat OpenShift API Satellite link endpoint by looking in the IBM Cloud Log Analysis logs for your Satellite location. To open these logs, click **Open Dashboard** under **Logging for Link**. You can set up a filter in the monitoring instance to filter out the value you need. For example, search for `flowlog: rejected by` in the log and you will see a rejected client IP. Add an ACL with a subnet matching that IP for your endpoint. This IP is logged when you use `oc` commands via link endpoint on the Red Hat OpenShift API. For more information, see [Logging for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-health&format=markdown).