<p>I just setup Istio on EKS. I noticed that the gateway controller (is that what I should call it?) creates an ELB and a corresponding security group  that allows incoming traffic on a few different ports:</p>

<p><a href="https://i.stack.imgur.com/hLn3C.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hLn3C.png" alt="Security Group Rules"></a></p>

<p>Right now, all of these rules allow traffic from everywhere (0.0.0.0/0), but I'd like to be able to restrict this to my VPN server. Is there a way to specify a security group id (ideally), or at least an IP for these rules?</p>

<p>There is a way to specify the Source IP for Inbound Rules of default Istio's Ingress Gateway during installation/upgrade of Istio via Helm.</p>

<p>You realize it by adjusting default values of Service object kind associated with   your istio-ingressgateway pod:</p>

<p>Here is how I'm doing it via Helm install:</p>

<ol>
<li>Install with helm using --set option to override default values (here default values of 'gateways' subcharts):</li>
</ol>

<blockquote>
<pre><code> $ helm install install/kubernetes/helm/istio --name istio-maxi --namespace istio-system \
  --set gateways.istio-ingressgateway.loadBalancerSourceRanges=143.231.0.0/16
</code></pre>
</blockquote>

<ol start="2">
<li>Here are the resulting Inbound Rules of ELB standing in front of
Istio Ingress Gateway seen in AWS console:</li>
</ol>

<p><a href="https://i.stack.imgur.com/ftIUX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ftIUX.png" alt="enter image description here"></a></p>

<p><strong>Important note:</strong></p>

<p>The <a href="https://github.com/istio/istio/commit/9708b61413eb07d3f5801a56811368a726d13d45" rel="nofollow noreferrer">loadBalancerSourceRanges</a> field is available by now still in a <strong>Pre-release</strong> state (1.1.0-snapshot.5) of Istio helm chart</p>
