Restrict the extension registry to internal traffic

Restrict your Open VSX registry to internal cluster traffic by removing the public route and configuring OpenShift Dev Spaces to use the internal service URL. Internal routing keeps extension registry traffic within the cluster and avoids public exposure.

Before you begin

  • You have Open VSX deployed in the openvsx project.
  • You have the oc tool installed.
  • You are logged in to the OpenShift cluster as a cluster administrator.
  • You have jq installed.

Procedure

  1. Delete the public route for the Open VSX registry: 
    oc delete route internal -n openvsx
  2. Update the CheCluster custom resource to use the internal service DNS URL: 
    export CHECLUSTER_NAME="$({orch-cli} get checluster --all-namespaces -o json | jq -r '.items[0].metadata.name')" &&
export CHECLUSTER_NAMESPACE="$({orch-cli} get checluster --all-namespaces -o json | jq -r '.items[0].metadata.namespace')" &&
export PATCH='{"spec":{"components":{"pluginRegistry":{"openVSXURL":"http://openvsx-server.openvsx.svc:8080"}}}}' &&
{orch-cli} patch checluster "${CHECLUSTER_NAME}" --type=merge --patch "${PATCH}" -n "${CHECLUSTER_NAMESPACE}"
  3. Restart any running workspaces to apply the new registry URL.

Results

  • Start a workspace and verify that extensions are available in the Extensions view using the internal registry.