<p>I have an nginx ingress in Kubernetes with both a whitelist (handled by a <code>nginx.ingress.kubernetes.io/whitelist-source-range</code> annotation) and also a custom port mapping (which exposes an SFTP server port 22 via a <code>--tcp-services-configmap</code> configmap).  The whitelist works great for 80 and 443, but it does not work for 22.  How do I whitelist my custom port?</p>
<p>Configuration looks roughly like this:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-ingress-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  ...
    spec:
      serviceAccountName: nginx-ingress-serviceaccount
      containers:
        - name: nginx-ingress-controller
          image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.33.0
          args:
            - /nginx-ingress-controller
            - --configmap=$(POD_NAMESPACE)/nginx-configuration
            - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
            - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
            - --publish-service=$(POD_NAMESPACE)/ingress-nginx
            - --annotations-prefix=nginx.ingress.kubernetes.io
          ports:
            - name: http
              containerPort: 80
            - name: https
              containerPort: 443
            - name: sftp
              containerPort: 22
        ...

kind: Ingress
metadata:
  name: {{ .controllerName }}
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/whitelist-source-range: {{ .ipAllowList }}

kind: ConfigMap
apiVersion: v1
metadata:
  name: tcp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
data:
  22: &quot;default/sftp:22&quot;

</code></pre>
<p>UPDATE</p>
<p>Thanks to @jordanm I discovered that I can restrict IP addresses for all ports via <code>loadBalancerSourceRanges</code> in the LoadBalancer rather than nginx:</p>
<pre><code>kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
  loadBalancerIP: {{ .loadBalancerIp }}
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: https
    - name: sftp
      port: 22
      targetPort: sftp
  loadBalancerSourceRanges:
    {{ .ipAllowList }}
</code></pre>

Lee Richardson
<p>Firstly take a look at this issue: <a href="https://www.google.com/url?q=https://github.com/kubernetes/ingress-nginx/issues/3202&amp;sa=D&amp;source=hangouts&amp;ust=1617960974480000&amp;usg=AFQjCNFEc_ZuZIZTwjqrhYMpnDtt1mztAg" rel="nofollow noreferrer">ip-whitelist-support</a>.</p>
<blockquote>
<p>IPs are not whitelisted for TCP services, an alternative would be to create a separate firewall for the TCP services and whitelist the IPs at the firewall level.</p>
</blockquote>
<p>For specific location <a href="https://www.google.com/url?q=https://github.com/kubernetes/ingress-nginx/blob/1b9a9e0fc4e17d88433f5b52f390f15e570c7287/rootfs/etc/nginx/template/nginx.tmpl%23L1085&amp;sa=D&amp;source=hangouts&amp;ust=1617960974480000&amp;usg=AFQjCNGaXNDfqS-uNt2_betPyIk3Kd2sQQ" rel="nofollow noreferrer">{{ $path }}</a>  we have defined
<a href="https://www.google.com/url?q=https://github.com/kubernetes/ingress-nginx/blob/1b9a9e0fc4e17d88433f5b52f390f15e570c7287/rootfs/etc/nginx/template/nginx.tmpl%23L1163&amp;sa=D&amp;source=hangouts&amp;ust=1617960974480000&amp;usg=AFQjCNGYgDKWUoRSzovTgcbBG2VIbpXwDA" rel="nofollow noreferrer">{{ if isLocationAllowed $location }}</a>.</p>
<p>Check official Ingress documentation: <a href="https://www.google.com/url?q=https://kubernetes.io/docs/concepts/services-networking/ingress/%23what-is-ingress&amp;sa=D&amp;source=hangouts&amp;ust=1617960974480000&amp;usg=AFQjCNFnS5b7LtmtJ5KN8HIFFshHOB8MLQ" rel="nofollow noreferrer">ingress-kubernetes</a>.</p>
<blockquote>
<p>Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. Traffic routing is controlled by rules  defined on the Ingress resource.</p>
<p>An Ingress does not expose arbitrary ports or protocols. Exposing services other than HTTP and HTTPS to the internet typically uses a service of type Service.Type=NodePort or Service.Type=LoadBalancer.</p>
<p>You must have an Ingress controller to satisfy an Ingress. Only
creating an Ingress resource has no effect.</p>
</blockquote>
<p>In this case Ingress resource instrument ingress-controller how to deal with http/https requests. In this approach nginx-ingress controller as a software (introduce layer-7 functionality/loadbalancing).</p>
<p>If you are interested with nginx ingress tcp support:</p>
<blockquote>
<p>Ingress does not support TCP or UDP services. For this reason this  Ingress controller uses the flags --tcp-services-configmap and  --udp-services-configmap</p>
</blockquote>
<p>See: <a href="https://www.google.com/url?q=https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/%23exposing-tcp-and-udp-services&amp;sa=D&amp;source=hangouts&amp;ust=1617960974480000&amp;usg=AFQjCNFUyG9Q0xncME9RAqvfoQOPA4nNag" rel="nofollow noreferrer">exposing-tcp-udp-services</a></p>
<p>If you want to check more granular configuration while working with your tcp service you should consider using L4 loadbalancing/firewall settings provided by your cloud provider.</p>
