Set GEN2 IP Allow List before Migration?

Summary:

In GEN2 the only way to assign an IP Allowlist appears to be via epmautomate but you can't login to a pod to upload the allowlist unless there's a service already there (i.e. you can't apply the allowlist until after the GEN2 migration which is a security risk)

Content (required):

We seem to be stuck in a loop: we're told to set our allowlist before the migration but we can't do that until the services are migrated.