<p>I'm being hit with a vulnerability probe which uses <code>User-Agent: Mozilla/5.0 Jorgee</code> and I want to drop/reject any requests from that user agent. </p>

<p>I've been digging around the k8s examples but I can't seem to find a solution.</p>

<p>Is there any way I can deny requests based on <code>User-Agent</code> with <code>gcr.io/google_contianers/nginx-ingress-controller:0.8.3</code>?</p>

<p>As best I can tell from <a href="https://github.com/kubernetes/ingress/blob/nginx-0.9.0-beta.13/controllers/nginx/rootfs/etc/nginx/template/nginx.tmpl" rel="nofollow noreferrer">the nginx go-template</a>, that is not something the current implementation of their ingress controller offers. I believe that in their mental model, one would wish to do that kind of suppression in a per-<code>Service</code> manner, since doing it in the <code>Ingress</code> controller could very easily apply that rule to the whole cluster, leading to surprising outcomes for other published <code>Service</code>s. I took a look at <a href="https://github.com/jcmoraisjr/haproxy-ingress/blob/v0.4-snapshot.4/rootfs/etc/haproxy/template/haproxy.tmpl" rel="nofollow noreferrer">the haproxy controller's go-template</a> and it seems to be true there, also.</p>

<p>At this point, I think you have two options:</p>

<ol>
<li><a href="https://github.com/kubernetes/ingress/blob/nginx-0.9.0-beta.13/examples/customization/custom-template/custom-template.yaml" rel="nofollow noreferrer">Use a custom nginx go-template file</a>, which might not be "bad" but one will need to exercise caution when doing upgrades, since your controller will no longer come with a known-correct <code>nginx.tmpl</code></li>
<li>Try <a href="https://github.com/appscode/voyager/blob/3.2.0/docs/user-guide/ingress/backend-rule.md" rel="nofollow noreferrer">a more advanced haproxy ingress controller</a>, which allows you to specify arbitrary haproxy snippets right in your Ingress resource, which is the best approach I have seen thus far, modulo their <code>backendRule</code> array seems <a href="https://kubernetes.io/docs/api-reference/v1.7/#ingressbackend-v1beta1-extensions" rel="nofollow noreferrer">not to be standard</a></li>
</ol>
