Whitelist an IP to access deployment with Kubernetes ingress Istio

Question

I'm trying to whitelist an IP to access a deployment inside my Kubernetes cluster.

I looked for some documentation online about this, but I only found the

ingress.kubernetes.io/whitelist-source-range

for ingress to grant access to certain IP range. But still, I couldn't manage to isolate the deployment.

Here is the ingress configuration YAML file:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-internal
  annotations:
    kubernetes.io/ingress.class: "istio"
    ingress.kubernetes.io/whitelist-source-range: "xxx.xx.xx.0/24, xx.xxx.xx.0/24"
spec:
  rules:
  - host: white.example.com
    http:
      paths:
      - backend:
          serviceName: white
          servicePort: 80

I can access the deployment from my whitelisted IP and from the mobile phone (different IP not whitelisted in the config)

Has anyone stepped in the same problem using ingress and Istio?

Any help, hint, docs or alternative configuration will be much appreciated.

Hi @Lan just wondering whether you got your answer already? – Agung Pratama Nov 22 '18 at 04:51 — Agung Pratama, Nov 22 '18 at 04:51

score 0 · Answer 1 · edited Jun 20 '20 at 09:12

0

Have a look at the annotation overview, it seems that whitelist-source-range is not supported by istio:

whitelist-source-range: Comma-separate list of IP addresses to enable access to.

nginx, haproxy, trafficserver

edited Jun 20 '20 at 09:12

Community

1
1

answered Sep 23 '17 at 18:30

user3151902

3,154
1
19
32

Agung Pratama · Answer 2 · 2018-10-30T11:03:20.433

I managed to solve whitelisting ip address problem for my istio-based service (app that uses istio proxy and exposed through the istio ingress gateway via public LB) using NetworkPolicy.

For my case, here is the topology:

Public Load Balancer (in GKE, using preserve clientIP mode) ==> A dedicated Istio Gateway Controller Pods (see my answer here) ==> My Pods (istio-proxy sidecar container, my main container).

So, I set up 2 network policy:

NetworkPolicy that guards the incoming connection from internet connection to my Istio Ingress Gateway Controller Pods. In my network policy configuration, I just have to set the spec.podSelector.matchLabels field to the pod label of Dedicated Istio Ingress Gateway Controller Pods's
Another NetworkPolicy that limits the incoming connection to my Deployment -> only from the Istio Ingress Gateway Controller pods/deployments.

Whitelist an IP to access deployment with Kubernetes ingress Istio

2 Answers2