<p>Running Kubernetes on GKE</p>

<p>Installed Nginx controller with latest stable release by using helm.</p>

<p>Everythings works well, except adding the whitelist-source-range annotation results in that I'm completely locked out from my service.</p>

<p>Ingress config</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: staging-ingress
  namespace: staging
  annotations:
    kubernetes.io/ingress.class: nginx
    ingress.kubernetes.io/whitelist-source-range: "x.x.x.x, y.y.y.y"
spec:
  rules:
    - host: staging.com
      http:
        paths:
        - path: /
          backend:
            serviceName:staging-service
            servicePort: 80
</code></pre>

<p>I connected to the controller pod and checked the nginx config and found this:</p>

<pre><code># Deny for staging.com/
geo $the_real_ip $deny_5b3266e9d666401cb7ac676a73d8d5ae {
    default 1;

    x.x.x.x 0;
    y.y.y.y 0;
}
</code></pre>

<p>It looks like he is locking me out instead of whitelist this IP's. But it also locking out all other addresses... I get 403 by going from staging.com host.</p>

<p>Yes. However, I figured out by myself. Your service has to be enabled <code>externalTrafficPolicy: Local</code>. That means that the actual client IP should be used instead of the internal cluster IP.</p>

<p>To accomplish this run
<code>kubectl patch svc nginx-ingress-controller -p '{"spec":{"externalTrafficPolicy":"Local"}}'</code></p>
