负载均衡器上的入口 IP 白名单 - aws k8s

Question

I am trying to use the Security group to allow https traffic only from a particular IP. I have created the Ingress Service and resource. (ref: NGINX Controller

I tried configuring below on Ingress Service.

kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {cert}
    # the backend instances are HTTP
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
    # Map port 443
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
    service.beta.kubernetes.io/aws-load-balancer-extra-security-groups: {SG Allowing ingres from IP}
spec:
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: http

I tried below on resource as well.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-extra-security-groups: {SG Allowing ingres from IP}
    ingress.kubernetes.io/whitelist-source-range: "IP"
spec:
  rules:
  - host: test.com
    http:
      paths:
      - backend:
          serviceName: backend
          servicePort: 8080
        path: /

What am I missing?

I see auto-generated SG on load balancer which allows all inbound traffic. But I'm not sure if its created by service or resource. And if its ok to edit that directly.

Update: Autogenerated SG

I added another SG which limits IP for ingress but doesn't get applied.

Answer 1

In your service definition of ingress add the following section

spec:
  loadBalancerSourceRanges: //add this section
    - 127.0.0.1/32
    - 28.50.20.12/31
  type: LoadBalancer

The default behavior is that when you don't specify loadBalancerSourceRanges it default into 0/0

Hope this helps.