

<h2>What I want to do</h2>

<p>I'd like to apply an IP whitelist defined in a ConfigMap. I'd like to keep the list external because it's easier to have it in one file rather than putting the blocks inline. The whitelist will be used by many services in different namespaces.</p>

<h2>What I Have</h2>

<p>A lot has been removed from the following spec files but hopefully enough has been retained.</p>

<p>I define the whitelist in a ConfigMap as:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ConfigMap
data:
  whitelist:
    # example
    - 127.0.0.1/32
    # etc.
metadata:
  name: whitelist
</code></pre>

<p>My Service, for this example, is:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Service
metadata:
  name: example
  labels:
    label: example
</code></pre>

<p>Note that the Service type is the default, as I rely on the Ingress to expose it. This cannot change.</p>

<p>The service sits behind an Ingress definition:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: example
  rules:
  - host: example.com
#... ports, etc
</code></pre>

<h2>What I've Tried</h2>

<h3>Changing Service type</h3>

<p>Defining the service as <code>type: LoadBalancer</code>. This does exactly what I want as it's easy to consume the ConfigMap, then I realized I cannot change the service type for business reasons.</p>

<h3>Using Ingress Annotations</h3>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: extensions/v1beta1
kind: Ingress
# ...
metadata:
  name: whitelist
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: "blockA", "blockB"
</code></pre>

<p>This kinda works but I couldn't figure out how to use the ConfigMap instead of the comma-separated list. I should note here that any solution that lets me use an externally-defined list is acceptable, and it doesn't have to be a ConfigMap just because.</p>

<h3>Using a <code>NetworkPolicy</code></h3>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: example-network-policy
spec:
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
      cidr: # hmm... can I add the ConfigMap here?
    - namespaceSelector:
      # ...etc
</code></pre>

<p>So far this looks the most promising, but the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#ipblock-v1-networking-k8s-io" rel="nofollow noreferrer"><code>ipBlock</code></a> selector seems to only accept one block...?</p>

rath
<blockquote>
  <p>Using Ingress Annotations</p>
</blockquote>

<p>ConfigMaps are not supported in annotations.</p>

<blockquote>
  <p>Using a NetworkPolicy</p>
</blockquote>

<p><code>ingress</code> and <code>egress</code> are array structures so you can try this, not sure if it works for you:</p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: example-network-policy
spec:
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
      cidr: &lt;cidr1&gt;
    - namespaceSelector:
      # ...etc
  - from:
    - ipBlock:
      cidr: &lt;cidr2&gt;
    - namespaceSelector:
      # ...etc
  - from:
    - ipBlock:
      cidr: &lt;cidr3&gt;
    - namespaceSelector:
      # ...etc
</code></pre>
