I have a subset of paths that I expose with an ingress. I'd like to block them for anyone coming through the ingress.

I'm trying this with a GCE Ingress

Adding a rule like:

 - host: my.example.com
    http:
      paths:
      - backend:
          serviceName: dead-end-backend
          servicePort: 80
        path: /private

This backend is designated dead-end using Nginx default backend deployment/service but it's not working well.

I'm not asking how to use the default-backend (but it solve it).

I'm asking for a proper way to do this.