Set and view the tenant allowlist

You can use the tenant allowlist feature to allow only specific clients to access a tenant.

Background information

The tenant allowlist contains a list of IP addresses of clients that are allowed to access a tenant. You can set the tenant allowlist based on your business requirements. IP addresses in the tenant allowlist can be in one of the following formats:

• Regular IP addresses. For example, 10.10.10.10,10.10.10.11

• Subnet/mask. For example, 10.10.10.0/24

• Fuzzy match. For example, 10.10.10.% or 10.10.10._

• Mixed format. For example, 10.10.10.10,10.10.10.11,10.10.10.%,10.10.10._,10.10.10.0/24

Set and view the tenant allowlist by using SQL statements

To set IP addresses in the tenant allowlist, you need to specify the ob_tcp_invited_nodes parameter, which is a global parameter for a tenant. The default value is 127.0.0.1,::1, which indicates that the tenant is accessible only to the clients on the server where the tenant is hosted.

To view and set the tenant allowlist by using SQL statements, perform the following operations:

1. Log on to the database as a tenant administrator.

2. Execute the following statement to view the tenant allowlist:

   obclient> SHOW VARIABLES LIKE 'ob_tcp_invited_nodes';
   +----------------------+-------+
   | Variable_name        | Value |
   +----------------------+-------+
   | ob_tcp_invited_nodes | %     |
   +----------------------+-------+
   

   A value of % indicates that the tenant is accessible to clients with any IP address.

3. To modify the allowlist, execute the following statements:

   For example:

   obclient> SET GLOBAL ob_tcp_invited_nodes='%';
   
   obclient> SET GLOBAL ob_tcp_invited_nodes='10.10.10.%';
   

View and set the tenant allowlist in the OCP console

You can also view and set the tenant allowlist in the OceanBase Cloud Platform (OCP) console.

1. Log on to the OCP console.

2. In the left-side navigation pane, click Tenants.

3. Click the name of the target tenant in the Tenants list.

4. On the Overview page, view the tenant allowlist in the Whitelist section.

   

5. To modify the allowlist, click Modify on the right side of the Whitelist section.

6. In the dialog box that appears, select Custom for IP Address Whitelist and modify the allowlist based on configuration instructions on the screen.

   

7. Click OK.