<p>I have a service that serves several /locations. I would like to make a single location /how/very/special reachable by any IP while keeping every other /location accessible only to a list of trusted IPs (which is trivial to do when you can </p>

<p>What is the best-practice way to achieve this via traefik or ingress controllers? Is a sidecar nginx the only way to add this logic?</p>

strzelecki.maciek
<p>You can achieve that by using Nginx ingress controller in Kubernetes as standing in documentation <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md#user-content-whitelist-source-range" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md#user-content-whitelist-source-range</a> </p>

<blockquote>
  <p>You can specify allowed client IP source ranges through the
  nginx.ingress.kubernetes.io/whitelist-source-range annotation. The
  value is a comma separated list of CIDRs, e.g. 10.0.0.0/24,172.10.0.1.</p>
  
  <p>To configure this setting globally for all Ingress rules, the
  whitelist-source-range value may be set in the NGINX ConfigMap.</p>
  
  <p>!!! note Adding an annotation to an Ingress rule overrides any global
  restriction.</p>
</blockquote>

<p>So as default you should put your trusted IP CIDRS in Nginx ConfigMap and override that rule only for <code>/how/very/special</code> by setting CIDR to 0.0.0.0/0</p>
