<p>I am aware that client affinity is possible for a LoadBalancer type service in Kubernetes. The thing is that this affinity doesn't forbid that two different clientes access the same pod. </p>

<p>Is it possible to associate a pod exclusively always to the same client?</p>

<p>Thanks in advance and have a really nice day!</p>

<p>To only allow a specific external client/s to access a specific Pod/Deployment you can use whitelisting/source ranges. Restrictions can be <a href="https://stackoverflow.com/questions/43849285/whitelist-filter-incoming-ips-for-https-load-balancer">applied to LoadBalancers</a> as <code>loadBalancerSourceRanges</code>. You add a section to the Service like:</p>

<pre><code>  loadBalancerSourceRanges:
  - 130.211.204.1/32
  - 130.211.204.2/32  
</code></pre>

<p>But <a href="https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/" rel="nofollow noreferrer">not all cloud providers currently support it</a>. </p>

<p>Alternatively you could expose the Pod with an Ingress and <a href="https://medium.com/@maninder.bindra/using-nginx-ingress-controller-to-restrict-access-by-ip-ip-whitelisting-for-a-service-deployed-to-bd5c86dc66d6" rel="nofollow noreferrer">apply whitelisting on the Ingress</a>. For whitelisting with an nginx Ingress you can add annotation to the Ingress such as <code>nginx.ingress.kubernetes.io/whitelist-source-range: 49.36.X.X/32</code></p>
