error.webhook.target_restricted
- Text in the console
- This webhook address points to a loopback, private or link-local network. Use a public address, or ask an administrator to allow the network in the controller configuration.
- Meaning for API clients
- The webhook target is a loopback, private, link-local or other restricted address that is not allow-listed.
- Code
INVALID_ARGUMENT, HTTP 400
| Argument | What it holds |
|---|---|
field | the request field that holds the rejected address, here url. |
url | the address that was refused, without credentials. |
Cause. The address of the webhook is a loopback, private, link-local or otherwise restricted network, and the network is not on the allow-list of the controller. Kyvernon refuses such targets so that a webhook cannot be used to reach internal services. The check applies to literal addresses and to the addresses that the host name resolves to.
Remedy.
- Use a public address for the webhook, for example a receiver on a public host name.
- When the receiver is inside your network on purpose, an administrator adds its network to
allowed_networksin the[webhooks]section of the controller configuration, for exampleallowed_networks = ["198.51.100.0/24"], and restarts the controller. - Create the subscription again:
kyvernon webhooks create <name> --url <url>.