Restrict ingress controller source CIDR blocks via bootstrap

[paulczar]

Summary

Allow customers to configure restrictive ingress source CIDR blocks (tighter than defaults) using a bootstrap/Argo-managed approach rather than complex Terraform scripting.

Context

Paul Foster raised security concerns that customers like NBN prefer more restrictive ingress source CIDR settings than the ROSA default allows out of the box.

The team agreed the preferred approach is to patch the default ingress controller using either:

• A Kubernetes Job run during bootstrap, or
• A bootstrap package managed by Argo CD

…rather than embedding complex scripting directly in Terraform.

Note: This is distinct from api_endpoint_allowed_cidrs (API endpoint SG rules in modules/infrastructure/cluster/10-main.tf). This issue targets application ingress (Routes/IngressController), not the cluster API endpoint.

Acceptance Criteria

• Document default ingress controller CIDR behavior and customer requirements (NBN as reference)
• Propose bootstrap mechanism (K8s Job vs. Helm chart in cluster-bootstrap) with pros/cons
• Implement configurable ingress source CIDR restriction via GitOps/bootstrap
• Avoid long-lived imperative logic in Terraform for ingress patching
• Test on a dev cluster; document operator configuration (e.g., cluster-adjacent config file per Refactor Terraform variables into external configuration file #27)
• Update enablement docs on GitHub Pages

Meeting reference

2026-07-03 — discussed NBN requirement and Argo/bootstrap approach (~00:10:09)

Related

• Refactor Terraform variables into external configuration file #27 — external config file next to cluster tfvars
• reference/validated-pattern-helm-charts/charts/cluster-bootstrap/