<p>I want to create IP based subdomain access rules for traefik (1.7.11) ingress controller running on Kubernetes (EKS). All IP's are allowed to talk to an external/frontend entry point</p>

<pre><code>traefik.toml: |
  defaultEntryPoints = ["http","https"]
  logLevel = "INFO"
  [entryPoints]
    [entryPoints.http]
      address = ":80"
      compress = true
      [entryPoints.http.redirect]
      entryPoint = "https"
      [entryPoints.http.whiteList]
      sourceRange = ["0.0.0.0/0"]
    [entryPoints.https]
      address = ":443"
      compress = true
      [entryPoints.https.tls]
      [entryPoints.https.whiteList]
      sourceRange = ["0.0.0.0/0"]
</code></pre>

<p>But we have only <code>prod</code> environments running in this cluster. </p>

<p>Want to limit certain endpoints like <code>monitoring.domain.com</code> accessible from limited IP's (Office location) and keep <code>*.domain.com</code> (default) accessible from the public internet.</p>

<p>anyway I can do it in <code>traefik</code> ?</p>

roy
<p>You can try using the <code>traefik.ingress.kubernetes.io/whitelist-source-range: "x.x.x.x/x, xxxx::/x"</code> <a href="https://docs.traefik.io/configuration/backends/kubernetes/#annotations" rel="nofollow noreferrer">Traefik annotation</a> on you <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a> object. You can also have 4 Ingress objects. One for each <code>stage.domain.com</code>, <code>qa.domain.com</code>, <code>dev.domain.com</code> and <code>prod.domain.com</code>.</p>

<p>For anything other than <code>prod.domain.com</code> you can add a whitelist.</p>

<p>Another option is to change your <code>traefik.toml</code> with <a href="https://docs.traefik.io/configuration/entrypoints/#white-listing" rel="nofollow noreferrer"><code>[entryPoints.http.whitelist]</code></a> but you may have to have different ingress controllers with a different <a href="https://docs.traefik.io/user-guide/kubernetes/#between-traefik-and-other-ingress-controller-implementations" rel="nofollow noreferrer">ingress class</a> for each environment.</p>
