osdocs5049c Replacing whitelist and blacklist references to allow and deny

Author: Daniel Chadwick

modules/nw-route-specific-annotations.adoc

@@ -9,7 +9,7 @@ The Ingress Controller can set the default options for all the routes it exposes
 
 [IMPORTANT]
 ====
-To create a whitelist with multiple source IPs or subnets, use a space-delimited list. Any other delimiter type causes the list to be ignored without a warning or error message.
+To create an allow list with multiple source IPs or subnets, use a space-delimited list. Any other delimiter type causes the list to be ignored without a warning or error message.
 ====
 
 //For all the variables outlined in this section, you can set annotations on the
@@ -38,7 +38,7 @@ Note: Using this annotation provides basic protection against denial-of-service
 |`haproxy.router.openshift.io/timeout-tunnel` | This timeout applies to a tunnel connection, for example, WebSocket over cleartext, edge, reencrypt, or passthrough routes. With cleartext, edge, or reencrypt route types, this annotation is applied as a timeout tunnel with the existing timeout value. For the passthrough route types, the annotation takes precedence over any existing timeout value set. | `ROUTER_DEFAULT_TUNNEL_TIMEOUT`
 |`ingresses.config/cluster ingress.operator.openshift.io/hard-stop-after` | You can set either an IngressController or the ingress config . This annotation redeploys the router and configures the HA proxy to emit the haproxy `hard-stop-after` global option, which defines the maximum time allowed to perform a clean soft-stop. | `ROUTER_HARD_STOP_AFTER`
 |`router.openshift.io/haproxy.health.check.interval`| Sets the interval for the back-end health checks. (TimeUnits) | `ROUTER_BACKEND_CHECK_INTERVAL`
-|`haproxy.router.openshift.io/ip_whitelist`
+|`haproxy.router.openshift.io/ip_allowlist`
 | Sets an allowlist for the route. The allowlist is a space-separated list of IP addresses and CIDR ranges for the approved source addresses. Requests from IP addresses that are not in the allowlist are dropped.
 
 The maximum number of IP addresses and CIDR ranges directly visible in the `haproxy.config` file is 61. [^1^] |
@@ -68,7 +68,7 @@ This value is applicable to re-encrypt and edge routes only. For more informatio
 |===
 [.small]
 --
-1. If the number of IP addresses and CIDR ranges in an allowlist exceeds 61, they are written into a separate file that is then referenced from `haproxy.config`. This file is stored in the `var/lib/haproxy/router/whitelists` folder.
+1. If the number of IP addresses and CIDR ranges in an allowlist exceeds 61, they are written into a separate file that is then referenced from `haproxy.config`. This file is stored in the `var/lib/haproxy/router/allowlists` folder.
 +
 [NOTE]
 ====
@@ -128,31 +128,31 @@ WebSocket connections to timeout frequently on that route.
 ----
 metadata:
   annotations:
-    haproxy.router.openshift.io/ip_whitelist: 192.168.1.10
+    haproxy.router.openshift.io/ip_allowlist: 192.168.1.10
 ----
 
 .A route that allows several IP addresses
 [source,yaml]
 ----
 metadata:
   annotations:
-    haproxy.router.openshift.io/ip_whitelist: 192.168.1.10 192.168.1.11 192.168.1.12
+    haproxy.router.openshift.io/ip_allowlist: 192.168.1.10 192.168.1.11 192.168.1.12
 ----
 
 .A route that allows an IP address CIDR network
 [source,yaml]
 ----
 metadata:
   annotations:
-    haproxy.router.openshift.io/ip_whitelist: 192.168.1.0/24
+    haproxy.router.openshift.io/ip_allowlist: 192.168.1.0/24
 ----
 
 .A route that allows both IP an address and IP address CIDR networks
 [source,yaml]
 ----
 metadata:
   annotations:
-    haproxy.router.openshift.io/ip_whitelist: 180.5.61.153 192.168.1.0/24 10.0.0.0/8
+    haproxy.router.openshift.io/ip_allowlist: 180.5.61.153 192.168.1.0/24 10.0.0.0/8
 ----
 
 .A route specifying a rewrite target

modules/security-network-egress.adoc

@@ -6,8 +6,7 @@
 =  Securing egress traffic
 
 {product-title} provides the ability to control egress traffic using either
-a router or firewall method. For example, you can use IP whitelisting to control
-database access.
+a router or firewall method. For example, you can use the IP allow list to control database access.
 A cluster administrator can assign one or more egress IP addresses to a project by xref:../../networking/ovn_kubernetes_network_provider/configuring-egress-ips-ovn.adoc#configuring-egress-ips-ovn[configuring an egress IP address].
 Likewise, a cluster administrator can prevent egress traffic from
 going outside of an {product-title} cluster using an egress firewall.