<p>I'm running a Django app on Azure Kubernetes Service and, for security purposes, would like to do the following: </p>

<ul>
<li>Completely block off the admin portal from the public (e.g. average Joe cannot reach <code>mysite.com/admin</code>)</li>
<li>Allow access through some backdoor (e.g. a private network, jump host, etc.)</li>
</ul>

<p>One scenario would be to run two completely separate services: 1) the main API part of the app which is just the primary codebase with the admin <strong>disabled</strong>. This is served publicly. and 2) Private site behind some firewall which has admin <strong>enabled</strong>. Each could be on a different cluster with a different FQDN but all connect to the same datastore. This is definitely overkill - there must be a way to keep everything within the cluster.</p>

<p>I'm think there might be a way to configure the Azure networking layer to block/allow traffic from specific IP ranges, and do it on a per-endpoint basis (e.g. <code>mysite.com/admin</code> versus <code>mysite.com/api/1/test</code>). Alternatively, maybe this is doable on a per-subdomain level (e.g. <code>api.mysite.com/anything</code> versus <code>admin.mysite.com/anything</code>).</p>

<p>This might also be doable at the Kubernetes ingress layer but I can't figure out how.</p>

<p>What is the easiest way to satisfy the 2 requirements?</p>

<p>You can manage restriction at ingress level : </p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/whitelist-source-range: "192.168.0.XXX, 192.175.2.XXX"
  name: staging-ingress
  namespace: default
spec:
  rules:
  - host: test.example.io
    http:
      paths:
      - backend:
          serviceName: service-name
          servicePort: 80
  tls:
  - hosts:
    - test.example.io
    secretName: tls-cert
</code></pre>

<p>You can white list the IP address for allowing specific path to resolve your backdoor issue. For other you can create another ingress rule with removing annotation for public accesss.</p>

<p>For a particular path : </p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/whitelist-source-range: "192.168.0.XXX, 192.175.2.XXX"
  name: staging-ingress
  namespace: default
spec:
  rules:
  - host: test.example.io
    http:
      paths:
      - path : /admin
        backend:
          serviceName: service-name
          servicePort: 80
  tls:
  - hosts:
    - test.example.io
    secretName: tls-cert
</code></pre>

<p>test.example.io/admin will only be accessible through source-range.</p>
