<p>I tried whitelisting IP address/es in my kubernetes cluster's incoming traffic using <a href="https://istio.io/docs/tasks/policy-enforcement/denial-and-list/#ip-based-whitelists-or-blacklists" rel="nofollow noreferrer">this</a> example :</p>

<p>Although this works as expected, wanted to go a step further and try if I can use <code>istio</code> gateways or virtual service when I set up Istio rule, instead of Loadbalancer(ingressgateway).</p>

<pre><code>apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: checkip
  namespace: my-namespace
spec:
  match: source.labels["app"] == "my-app"
  actions:
  - handler: whitelistip.listchecker
    instances:
    - sourceip.listentry
---
</code></pre>

<p>Where <code>my-app</code> is of <code>kind: Gateway</code> with a certain host and port, and labelled <code>app=my-app</code>.</p>

<p>Am using istio version 1.1.1
Also my cluster has all the istio-system running with envoy sidecars on almost all service pods.</p>

<p>You confuse one thing that, in above rule, <code>match: source.labels["app"] == "my-app"</code> is not referring to any resource's label, but to pod's label.</p>

<p>From <a href="https://istio.io/docs/reference/config/policy-and-telemetry/templates/kubernetes/#OutputTemplate" rel="nofollow noreferrer">OutputTemplate Documentation</a>:</p>

<blockquote>
  <p>sourceLabels  | Refers to source pod labels.
  attributebindings can refer to this field using $out.sourcelabels</p>
</blockquote>

<p>And you can verify by looking for resources with "app=istio-ingressgateway" label via:</p>

<pre><code>kubectl get pods,svc -n istio-system -l "app=istio-ingressgateway" --show-labels
</code></pre>

<p>You can check this <a href="https://istio.io/blog/2017/adapter-model/" rel="nofollow noreferrer">blog</a> from istio about Mixer Adapter Model, to understand complete mixer model, its handlers,instances and rules.</p>

<p>Hope it helps!</p>
