Add support for IP/CIDR whitelisting of the incoming traffic

[andrey-dubnik]

Hi,

As an endpoint can be exposed towards the internet it is nice to be able to limit the access to a set of IPs and CIDRs. There are few expose types within ISPN operator configuration and hopefully all support IP whitelisting.

e.g. for the LoadBalancer It could be done by adding loadBalancerSourceRanges to the External Service definition (works in EKS, AKS, GCP and likely OC.

It used to be an easier option of using the annotation service.beta.kubernetes.io/load-balancer-source-ranges but it seem to be deprecated now and a recommendation is to use the spec.loadBalancerSourceRanges on the Service resource instead.

Does it makes sense to add feature like this?

Thanks,
Andrey

[ryanemerson]

I think that makes sense, we could expose this configuration as follows:

spec:
  expose:
    type: LoadBalancer
    port: 65535
    loadBalancerSourceRanges:
      - 0.0.0.0/0

We would then throw an error on the validating webhook if this element is specified with type=NodePort|Route

[ryanemerson]

Actually, a more generic solution such as the following would be more flexible. We can then configure the different expose types appropriately if supported (I haven't looked into the implementation details yet):

spec:
  expose:
    type: LoadBalancer
    port: 65535
    sourceRanges:
      - 0.0.0.0/0

[andrey-dubnik]

I was thinking about the generic one as well, e.g. OC route supports whitelisting via haproxy.router.openshift.io/ip_whitelist annotation accordingly to a doc, k8s service via loadBalancerSourceRanges with LoadBalancer type. NodePort is formally a Service resource but I'm not sure if loadBalancerSourceRanges works the same way over there.