<p>I am trying to achieve <strong>Client IP based routing</strong> using Istio features.</p>
<p>I have two versions of application <strong>V1(Stable)</strong> and <strong>V2(Canary)</strong>. I want to route the traffic to the canary version(V2) of the application if the Client IP is from a particular CIDR block (Mostly the CIDR my org) and all other traffic should be routed to the stable version(V1) which is the live traffic.</p>
<p>Is there any way to achieve this feature using Istio?</p>

AkshayBadri
<p>Yes, this is possible.</p>
<hr />
<p>Since you have a <code>load balancer</code> in front of the kubernetes cluster, first question to address is <strong>preserve</strong> <code>client IP</code> because due to NAT <code>load balancer</code> opens another session to the internal side to kubernetes cluster and <code>source IP</code> is lost. It has to be preserved. This can be done in different ways depending on <code>load balancer</code> type used. Please see:</p>
<p><a href="https://istio.io/latest/docs/tasks/security/authorization/authz-ingress/#source-ip-address-of-the-original-client" rel="nofollow noreferrer">Source IP address of the original client</a></p>
<hr />
<p>Next part is to configure a <code>virtual service</code> to route the traffic based on <code>client IP</code>. It was solutioned for HTTP traffic. Below is a working example:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: app-vservice
  namespace: test
spec:
  hosts:
  - &quot;app-service&quot;
  http:
  - match:
    - headers:
        x-forwarded-for:
          exact: 123.123.123.123
    route:
    - destination:
        host: app-service
        subset: v2
  - route:
    - destination:
        host: app-service
        subset: v1
</code></pre>
<p><a href="https://github.com/istio/istio/issues/24852#issuecomment-647831912" rel="nofollow noreferrer">Source - Github issue comment</a></p>
<p>There is also a <a href="https://github.com/istio/istio/issues/24852#issuecomment-647704245" rel="nofollow noreferrer">comment</a> about TCP and usage <code>addresses</code> in <code>ServiceEntry</code>.</p>
