<p>I've deployed an application on aws using kops and ingress nginx controller.</p>

<p>From what I’ve understood it looks like ingress controller allows to expose each services deployed in the cluster publicly. So it makes me wonder about security and authentication.</p>

<p>What is the architecture of my project ?
I got 3 services deployed in a cluster:</p>

<ol>
<li><p>-client-ui (front-end)</p></li>
<li><p>-authentication-api (creates/generates/verifies JWT token and call other services like data-api)</p></li>
<li><p>-data-api (an API that create/read/update/delete sensitive data in the DB)</p></li>
</ol>

<p>So the question is: if Ingress controller exposes all services, how do you restrict access to specific service, if the user is not allowed to ?</p>

<p>In this case data-api should only be accessible from authentication-api. So if in my browser I type
www.client-ui.com/data/getXXX obviously I should not be be able to access that endpoint. I should only be able to do it from authentication-api if his jwt token has been verified.</p>

<p>So I guess some apis should be accessible only from within the cluster and some publicly !?</p>

<p>Could you please explain how can I do that ?</p>

<p>Thanks</p>

jaybe78
<p>Depending on the cloud provider, there are different annotations on the ingress services for that. What you want is an internal load balancer for a specific ingress resource.
In your case (AWS) this should be:</p>

<p><code>annotations:
  service.beta.kubernetes.io/aws-load-balancer-internal: "true"</code></p>

<p>See:</p>

<ul>
<li><a href="https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/</a></li>
<li><a href="https://github.com/kubernetes/ingress-nginx/blob/c3ce6b892e5f1cc1066f81c19482dded2901ad45/docs/user-guide/multiple-ingress.md" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/blob/c3ce6b892e5f1cc1066f81c19482dded2901ad45/docs/user-guide/multiple-ingress.md</a></li>
</ul>
