IP Allowlisting

Every cluster defaults to open access (0.0.0.0/0 and ::/0 - any IPv4 or IPv6 address). To restrict access to known networks, set the allowlist field(s) to a list of CIDR ranges (a single IP works too, as a /32 or /128).

An empty result is the same as 0.0.0.0/0/::/0 being absent, not “deny everything” - always include at least one range once you’re setting this field at all. Double-check whatever address range your own tooling connects from (a CI runner, a remote-write agent, an office network) is covered before narrowing it, since a mismatched allowlist fails closed with no other signal beyond connection timeouts/refusals at the network layer - it doesn’t reach the credential check at all.

OpenSearch

ClusterNest Managed OpenSearch Service has two independent allowlists, matching its two hostnames:

• ip_allowlist - the OpenSearch API.
• dashboards_ip_allowlist - OpenSearch Dashboards.

Console

1. Open the cluster form: Launch Cluster for a new cluster, or Edit on an existing one.
2. Under OpenSearch Allowlist, click Add IP/Subnet and enter a range. Repeat for each range.
3. Do the same under OpenSearch Dashboards Allowlist.
4. Save the cluster.

Terraform

resource "clusternest_opensearch" "logs" {
  # ...
  ip_allowlist            = ["203.0.113.0/24", "198.51.100.42/32"]
  dashboards_ip_allowlist = ["203.0.113.0/24"]
}

See the resource reference for every field.

Raw API

PUT replaces the whole cluster, not just the fields you send

Any field left out of the request body resets to its schema default, not its current value - GET the cluster first, merge in the change, then PUT the merged result back.

Secrets are the exception: GET never returns client_secret or secret_access_key, only client_secret_set and secret_access_key_set. Leave a secret out of the body to keep the stored one, or include it to replace it. The *_set flags are ignored on write, so the merged result can be sent back as is.

curl "https://api.clusternest.com/cluster/opensearch/$CLUSTER_ID" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  | jq '.ip_allowlist = ["203.0.113.0/24", "198.51.100.42/32"]
      | .dashboards_ip_allowlist = ["203.0.113.0/24"]' \
  > cluster.json

curl -X PUT "https://api.clusternest.com/cluster/opensearch/$CLUSTER_ID" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @cluster.json

Prometheus

ClusterNest Managed Prometheus has one allowlist, covering the whole endpoint (query and push paths alike):

• ip_allowlist

Console

1. Open the cluster form: Launch Cluster for a new cluster, or Edit on an existing one.
2. Under Prometheus Allowlist, click Add IP/Subnet and enter a range. Repeat for each range.
3. Save the cluster.

Terraform

resource "clusternest_prometheus" "metrics" {
  # ...
  ip_allowlist = ["203.0.113.0/24", "198.51.100.42/32"]
}

See the resource reference for every field.

Raw API

PUT replaces the whole cluster, not just the fields you send

Any field left out of the request body resets to its schema default, not its current value - GET the cluster first, merge in the change, then PUT the merged result back.

curl "https://api.clusternest.com/cluster/prometheus/$CLUSTER_ID" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  | jq '.ip_allowlist = ["203.0.113.0/24", "198.51.100.42/32"]' \
  > cluster.json

curl -X PUT "https://api.clusternest.com/cluster/prometheus/$CLUSTER_ID" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @cluster.json