<p>I've got a Kubernetes cluster with nginx ingress setup for public endpoints. That works great, but I have one service that I don't want to expose to the public, but I do want to expose to people who have vpc access via vpn. The people who will need to access this route will not have kubectl setup, so they can't use <code>port-forward</code> to send it to localhost.</p>

<p>What's the best way to setup ingress for a service that will be restricted to only people on the VPN?</p>

<p>Edit: thanks for the responses. As a few people guessed I'm running an EKS cluster in AWS.</p>

<p>It depends a lot on your Ingress Controller and cloud host, but roughly speaking you would probably set up a second copy of your controller using a internal load balancer service rather than a public LB and then set that service and/or ingress to only allow from the IP of the VPN pods.</p>
