<p>I read through the kubernetes <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">network policy documentation</a> and stumbled upon this statement:</p>
<blockquote>
<h3>What you can't do with network policies (at least, not yet)</h3>
<p>The ability to explicitly deny policies (currently the model for NetworkPolicies are deny by default, with only the ability to add allow rules).</p>
</blockquote>
<p>Is there a way around this limiting factor or any add on to kubernetes that allows for blacklisting IPs?</p>

8bit
<p>You can use 3rd party for this task.</p>
<p>Few examples:</p>
<ol>
<li><p><a href="https://docs.aws.amazon.com/eks/latest/userguide/restrict-service-external-ip.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/restrict-service-external-ip.html</a></p>
</li>
<li><p><a href="https://istio.io/v1.1/docs/tasks/policy-enforcement/denial-and-list/#ip-based-whitelists-or-blacklists" rel="nofollow noreferrer">https://istio.io/v1.1/docs/tasks/policy-enforcement/denial-and-list/#ip-based-whitelists-or-blacklists</a></p>
</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: config.istio.io/v1alpha2
kind: listchecker
metadata:
  name: whitelistip
spec:
  # providerUrl: ordinarily black and white lists are maintained
  # externally and fetched asynchronously using the providerUrl.
  overrides: [&quot;10.57.0.0/16&quot;]  # overrides provide a static list
  blacklist: false
  entryType: IP_ADDRESSES
---
apiVersion: config.istio.io/v1alpha2
kind: listentry
metadata:
  name: sourceip
spec:
  value: source.ip | ip(&quot;0.0.0.0&quot;)
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: checkip
spec:
  match: source.labels[&quot;istio&quot;] == &quot;ingressgateway&quot;
  actions:
  - handler: whitelistip.listchecker
    instances:
    - sourceip.listentry
---
</code></pre>
<ol start="3">
<li>With nginx</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
    nginx.ingress.kubernetes.io/use-regex: &quot;true&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    
    #
    # This is the relevant part
    #
    
    nginx.ingress.kubernetes.io/whitelist-source-range: 49.36.X.X/32
    # depending on the ingress controller version the annotation
    # above may need to be modified to remove the prefix nginx. i.e.
    # ingress.kubernetes.io/whitelist-source-range: 49.36.X.X/32
spec:
  rules:
  - host: web.manitestdomain.com
    http:
      paths:
      - path: /(.*)
        pathType: Prefix
        backend:
          service:
            name: web
            port:
              number: 80
</code></pre>
