<p>TLDR: need an IP whitelist that is updated every five minutes to restrict access to services</p>
<p>Hy there</p>
<p>I'm currently migrating our VMs into two Kubernetes clusters (prod and dev).
Till now we have managed the access to our system with network access policies that are updated every five minutes.
Every environment had its own VM and thus the setup of policies was easy.
Our hosting partner is Open Telekom Cloud (OTC).</p>
<p>Now with Kubernetes we run multiple environments on one cluster and network access policies would affect all hosted environments on the cluster.</p>
<p>The dev cluster hosts Preview, Dev1, Stage, ...
Preview should have no access restrictions, all other environments should be limited by an IP whitelist.</p>
<ol>
<li><p>Is it possible to keep an global ip whitelist, that is updated every five minutes, to limit access to some services? Are the updates distributed automatically?</p>
</li>
<li><p>Would I do the limiting in ingresses or should I use networkPolicies</p>
</li>
<li><p>Is there another way to achieve this?</p>
</li>
</ol>
<p>Greetings from Munich</p>
<p>Edit:
Thanks a lot to @harsh-manvar</p>
<p>His solutions will help a lot on basically every managed Kubernetes service.
Sadly we are restricted to the one from Telekom DE (OTC CCE)</p>
<ul>
<li>NetworkPolicies can not block IPs there</li>
<li>The Ingress Controller implementation of OTC does not allow IP whitelisting (or blacklisting). They are on it thought (should hopefully be delivered in late 2022)</li>
<li>Load balancer blocking does not work either</li>
</ul>
<p>We ended up with an Web Application Firewall (150€/month per domain) that forwards/blocks requests based on the IP.</p>

Aaron Dietz
<blockquote>
<p>Is it possible to keep an global ip whitelist, that is updated every
five minutes, to limit access to some services? Are the updates
distributed automatically?</p>
</blockquote>
<p>Yes, it is possible by managing the and whitelisting the traffic over the ingress or gateway (Istio, Kong, KrakenD) if you are using any</p>
<p>You can manage the YAML files with config or configuration management tool and CI/CD process to changes get apply each time so this way it will easy to manage also.</p>
<blockquote>
<p>Would I do the limiting in ingresses or should I use networkPolicies</p>
</blockquote>
<p>It's more depends on the requirement, If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then you might consider using Kubernetes NetworkPolicies for particular applications in your cluster.</p>
<p>For ingress whitelisting</p>
<pre><code>annotations: 
  nginx.ingress.kubernetes.io/whitelist-source-range: &quot;0.0.0.0/24&quot;
</code></pre>
<blockquote>
<p>Is there another way to achieve this?</p>
</blockquote>
<p>You can also implement the <code>load balancer</code> source ranges filter at the K8s <strong>service</strong> level also.</p>
