--- title: "Kubernetes Quick Tip: Whitelisting Source IP with Ingress in Kubernetes" description: Restrict access to your application using nginx ingress-controller in Kubernetes. image: http://cdn2.hubspot.net/hubfs/2668666/All-InOne-2016/Image/bg-img.jpg --- Check out our **[Cloud Native Services](https://www.container-solutions.com/services) **and** **book a call with one of our experts today!  [![Container Solutions](https://blog.container-solutions.com/hubfs/CS_blog/logo-main.svg "Container Solutions")](http://container-solutions.com) - share: - [**](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.container-solutions.com%2Fkubernetes-quick-tip) - [**](https://www.twitter.com/share?url=https%3A%2F%2Fblog.container-solutions.com%2Fkubernetes-quick-tip) - [**](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.container-solutions.com/kubernetes-quick-tip) - [**](https://blog.container-solutions.com/kubernetes-quick-tip#) [![](http://cdn2.hubspot.net/hubfs/2668666/All-InOne-2016/Image/bg-img.jpg) ](https://blog.container-solutions.com/kubernetes-quick-tip) [Cloud native](https://blog.container-solutions.com/tag/cloud-native), [Docker](https://blog.container-solutions.com/tag/docker), [Kubernetes](https://blog.container-solutions.com/tag/kubernetes), [Microservices](https://blog.container-solutions.com/tag/microservices), [Miscellaneous](https://blog.container-solutions.com/tag/miscellaneous) # Kubernetes Quick Tip: Whitelisting Source IP with Ingress in Kubernetes [Michael Müller](https://blog.container-solutions.com/author/michael-müller) ![Michael Müller](https://blog.container-solutions.com/hubfs/CS--Dev__Assets/asset%2017.jpeg) February 10, 2017 3 minutes Read If you are using Ingress on your Kubernetes cluster it is possible to restrict access to your application based on dedicated IP addresses. One possible use case would be that you have a development setup and don't want to make all the fancy new features available to everyone, especially competitors. In such cases, IP whitelisting to restrict access can be used .This can be done with specifying the allowed client IP source ranges through the `ingress.kubernetes.io/whitelist-source-range` annotation. The value is a comma separated list of CIDR block, e.g. 10.0.0.0/24,1.1.1.1/32.   If you want to set a default global set of IPs this needs to be set in the config of the ingress-controller. In the example below we use the [NGINX ingress-controller](https://github.com/kubernetes/ingress/blob/master/controllers/nginx/configuration.md) and could set that default value in the [config-map](https://github.com/nginxinc/kubernetes-ingress/blob/master/examples/daemon-set/nginx-ingress.yaml) used for the ingress-controller. The global value can be overwritten using annotation in the Ingress rule. Please note that not all ingress-controllers support whitelisting, please check the documentation of the ingress-controller you're using. The configuration: ``` apiVersion: extensions/v1beta1 kind: Ingress metadata: name: whitelist annotations: ingress.kubernetes.io/whitelist-source-range: "1.1.1.1/24" spec: rules: - host: whitelist.test.net http: paths: - path: / backend: serviceName: webserver servicePort: 80 ``` Testing with the annotation set: ``` curl -v -H "Host: whitelist.test.net" /graph (out)* Trying ... (out)* TCP_NODELAY set (out)* Connected to () port 80 (#0) (out)> GET /graph HTTP/1.1 (out)> Host: whitelist.test.net (out)> User-Agent: curl/7.51.0 (out)> Accept: */* (out)> (out)< HTTP/1.1 403 Forbidden (out)< Server: nginx/1.11.3 (out)< Date: Tue, 07 Feb 2017 09:46:51 GMT (out)< Content-Type: text/html (out)< Content-Length: 169 (out)< Connection: keep-alive (out)<403 Forbidden (out)<center> (out)<h1>403 Forbidden</h1> (out)</center><hr><center>nginx/1.11.3</center> (out)* Curl_http_done: called premature == 0 * Connection #0 to host left intact ``` Testing without the annotation set: ``` curl -v -H "Host: whitelist.test.net" /graph (out)* Trying ... (out)* TCP_NODELAY set (out)* Connected to () port 80 (#0) (out)> GET /graph HTTP/1.1 (out)> Host: whitelist.test.net (out)> User-Agent: curl/7.51.0 (out)> Accept: */* (out)> (out)< HTTP/1.1 200 OK (out)< Server: nginx/1.11.3 (out)< Date: Tue, 07 Feb 2017 09:49:01 GMT (out)< Content-Type: text/html; charset=utf-8 (out)< Transfer-Encoding: chunked (out)< Connection: keep-alive (out)* Curl_http_done: called premature == 0 (out)* Connection #0 to host left intact ``` Using this simple annotation, you're able to restrict who can access the applications in your kubernetes cluster by its IPs. [![Download the Cloud Native Attitude book for free](https://no-cache.hubspot.com/cta/default/2252258/ac93f2fd-838a-41d9-baa1-49b957ca2622.png)](https://cta-redirect.hubspot.com/cta/redirect/2252258/ac93f2fd-838a-41d9-baa1-49b957ca2622)   [### Surprise at Golang Thread Scheduling ](https://blog.container-solutions.com/surprise-golang-thread-scheduling) [![prev-arrow](https://cdn2.hubspot.net/hubfs/3842749/Wow%202019/Images/left-arrow.png) Previous article](https://blog.container-solutions.com/surprise-golang-thread-scheduling) [ Next article ![next-arrow](https://cdn2.hubspot.net/hubfs/3842749/Wow%202019/Images/right-arrow.png) ](https://blog.container-solutions.com/minimesos-0-11-1-docker-mac-improved-default-resources) [ ### minimesos 0.11.1 - Docker on Mac and improved default resour... ](https://blog.container-solutions.com/minimesos-0-11-1-docker-mac-improved-default-resources) Comments Leave your Comment ![cs-logo-white](https://blog.container-solutions.com/hs-fs/hubfs/cs-logo-white.png?width=150&height=61&name=cs-logo-white.png "cs-logo-white") #### **Talk to sales** [info@container-solutions.com](mailto:info@container-Solutions.com) #### Stay In Touch - [**](https://www.linkedin.com/company/container-solutions/) - [**](https://twitter.com/containersoluti) © 2024 Container Solutions