K
Q

Whitelist an IP to access deployment with Kubernetes ingress Istio

9/20/2017

I'm trying to whitelist an IP to access a deployment inside my Kubernetes cluster.

I looked for some documentation online about this, but I only found the

ingress.kubernetes.io/whitelist-source-range

for ingress to grant access to certain IP range. But still, I couldn't manage to isolate the deployment.

Here is the ingress configuration YAML file:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-internal
  annotations:
    kubernetes.io/ingress.class: "istio"
    ingress.kubernetes.io/whitelist-source-range: "xxx.xx.xx.0/24, xx.xxx.xx.0/24"
spec:
  rules:
  - host: white.example.com
    http:
      paths:
      - backend:
          serviceName: white
          servicePort: 80

I can access the deployment from my whitelisted IP and from the mobile phone (different IP not whitelisted in the config)

Has anyone stepped in the same problem using ingress and Istio?

Any help, hint, docs or alternative configuration will be much appreciated.

-- Lan
docker-ingress
istio
kubernetes
kubernetes-security
whitelist

Similar Questions

Add to keycloak k8s helm chart environment parameters of outside Postgres database
Not access from manager to node application Kubernetes cluster
Metric Absence Alert on Logs-based Metrics from Pod Triggered on Pod Reschedule
How to refer to variables in a Kubernetes deployment file?

2 Answers

9/23/2017

Have a look at the annotation overview, it seems that whitelist-source-range is not supported by istio:

whitelist-source-range: Comma-separate list of IP addresses to enable access to.

nginx, haproxy, trafficserver

-- user3151902
Source: StackOverflow
10/30/2018

I managed to solve whitelisting ip address problem for my istio-based service (app that uses istio proxy and exposed through the istio ingress gateway via public LB) using NetworkPolicy.

For my case, here is the topology:

Public Load Balancer (in GKE, using preserve clientIP mode) ==> A dedicated Istio Gateway Controller Pods (see my answer here) ==> My Pods (istio-proxy sidecar container, my main container).

So, I set up 2 network policy:

  1. NetworkPolicy that guards the incoming connection from internet connection to my Istio Ingress Gateway Controller Pods. In my network policy configuration, I just have to set the spec.podSelector.matchLabels field to the pod label of Dedicated Istio Ingress Gateway Controller Pods's

  2. Another NetworkPolicy that limits the incoming connection to my Deployment -> only from the Istio Ingress Gateway Controller pods/deployments.

-- Agung Pratama
Source: StackOverflow