<p>I'm having trouble setting up an ingress open only to some specific IPs, checked docs, tried a lot of stuff and an IP out of the source keep accessing. that's a Zabbix web interface on an alpine with nginx, set up a service on node-port 80 then used an ingress to set up a loadbalancer on GCP, it's all working, the web interface is working fine, but how can I make it accessible only to desired IPs? 
my firewall rules are ok and it's only accessible through load balancer IP</p>

<p>Also, I have a specific namespace for this deploy.</p>

<p>Cluster version <code>1.11.5-gke.5</code> 
<strong>EDIT</strong> i'm using GKE standard ingress GLBC</p>

<p>My template is config as follow can someone help enlighten me on what is missing:</p>

<pre><code>    apiVersion: v1
    kind: ReplicationController
    metadata:
      name: zabbix-web
      namespace: zabbix-prod
      labels:
        app: zabbix
        tier: frontend
    spec:
      replicas: 1
      template:
        metadata:
          labels:
            name: zabbix-web
            app: zabbix
        spec:
          volumes:
          - name: cloudsql-instance-credentials
            secret:
              defaultMode: 420
              secretName: cloudsql-instance-credentials
          containers:
            - command:
              - /cloud_sql_proxy
              - -instances=&lt;conection&gt;
              - -credential_file=/secrets/cloudsql/credentials.json
              image: gcr.io/cloudsql-docker/gce-proxy:1.11
              imagePullPolicy: IfNotPresent
              name: cloudsql-proxy
              resources: {}
              securityContext:
                allowPrivilegeEscalation: false
                runAsUser: 2
              terminationMessagePath: /dev/termination-log
              terminationMessagePolicy: File
              volumeMounts:
              - mountPath: /secrets/cloudsql
                name: credentials
                readOnly: true
            - name: zabbix-web
              image: zabbix/zabbix-web-nginx-mysql:alpine-3.2-latest
              ports:
              - containerPort: 80
              env:
              - name: MYSQL_USER
                valueFrom:
                  secretKeyRef:
                    key: &lt;user&gt;
                    name: &lt;user&gt;
              - name: MYSQL_PASSWORD
                valueFrom:
                  secretKeyRef:
                    key: &lt;pass&gt;
                    name: &lt;pass&gt;
              - name: DB_SERVER_HOST
                value: 127.0.0.1
              - name: MYSQL_DATABASE
                value: &lt;db&gt;
              - name: ZBX_SERVER_HOST
                value: &lt;db&gt;
            readinessProbe:
              failureThreshold: 3
              httpGet:
                path: /index.php
                port: 80
                scheme: HTTP
              periodSeconds: 10
              successThreshold: 1
              timeoutSeconds: 30
---
apiVersion: v1
kind: Service
metadata:
  name: "zabbix-web-service"
  namespace: "zabbix-prod"
  labels:
    app: zabbix
spec:
  ports:
  - port: 80
    targetPort: 80
  selector:
    name: "zabbix-web"
  type: "NodePort"
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: zabbix-web-ingress
  namespace: zabbix-prod
  annotations:
    ingress.kubernetes.io/service.spec.externalTrafficPolicy: local
    ingress.kubernetes.io/whitelist-source-range: &lt;xxx.xxx.xxx.xxx/32&gt;
spec:
  tls:
  - secretName: &lt;tls-cert&gt;
  backend:
    serviceName: zabbix-web-service
    servicePort: 80
</code></pre>

Liz Neto
<p>You can whitelist IPs by <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig" rel="nofollow noreferrer">configuring Ingress and Cloud Armour</a>:</p>
<p>Switch to project:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud config set project $PROJECT
</code></pre>
<p>Create a policy:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud compute security-policies create $POLICY_NAME --description &quot;whitelisting&quot;
</code></pre>
<p>Change default policy to deny:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud compute security-policies rules update 2147483647 --action=deny-403 \ 
  --security-policy $POLICY_NAME
</code></pre>
<p>On lower priority than the default whitelist all IPs you want to whitelist:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud compute security-policies rules create 2 \
  --action allow \
  --security-policy $POLICY_NAME \
  --description &quot;allow friends&quot; \
  --src-ip-ranges &quot;93.184.17.0/24,151.101.1.69/32&quot;
</code></pre>
<p>With a maximum of ten per range.</p>
<p>Note you need valid CIDR ranges, for that you can use <a href="https://www.ipaddressguide.com/cidr" rel="nofollow noreferrer">CIDR to IP Range -&gt; IP Range to CIDR</a>.</p>
<p>View the policy as follows:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud compute security-policies describe $POLICY_NAME
</code></pre>
<p>To throw away an entry:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud compute security-policies rules delete $PRIORITY --security-policy $POLICY_NAME
</code></pre>
<p>or the full policy:</p>
<pre class="lang-sh prettyprint-override"><code>gcloud compute security-policies delete $POLICY_NAME
</code></pre>
<p>Create a <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig#creating_a_backendconfig" rel="nofollow noreferrer">BackendConfig</a> for the policy:</p>
<pre class="lang-sh prettyprint-override"><code># File backendconfig.yaml:
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  namespace: &lt;namespace&gt;
  name: &lt;name&gt;
spec:
  securityPolicy:
    name: $POLICY_NAME

$ kubectl apply -f backendconfig.yaml
backendconfig.cloud.google.com/backendconfig-name created
</code></pre>
<p>Add the BackendConfig to the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig#creating_a_service" rel="nofollow noreferrer">Service</a>:</p>
<pre class="lang-sh prettyprint-override"><code>metadata:
  namespace: &lt;namespace&gt;
  name: &lt;service-name&gt;
  labels:
    app: my-app
  annotations:
    cloud.google.com/backend-config: '{&quot;ports&quot;: {&quot;80&quot;:&quot;backendconfig-name&quot;}}'
spec:
  type: NodePort
  selector:
    app: hello-app
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
</code></pre>
<p>Use the right selectors and point the receiving port of the Service to the BackendConfig created earlier.</p>
<p>Now Cloud Armour will add the policy to the GKE service.</p>
<p>Visible in <a href="https://console.cloud.google.com/net-security/securitypolicies" rel="nofollow noreferrer">https://console.cloud.google.com/net-security/securitypolicies</a> (after selecting <code>$PROJECT</code>).</p>
