<p>I am trying to lock down my kubernetes cluster and currently use cloudflare on the front in I am trying to whitelist cloudflare's IPs</p>

<p>this is in my service yaml:</p>

<pre><code>spec:
  type: LoadBalancer
  loadBalancerSourceRanges:
  - 130.211.204.1/32
  - 173.245.48.0/20
  - 103.21.244.0/22
  - 103.22.200.0/22
  - 103.31.4.0/22
  - 141.101.64.0/18
  - 108.162.192.0/18
  - 190.93.240.0/20
  - 188.114.96.0/20
  - 197.234.240.0/22
  - 198.41.128.0/17
  - 162.158.0.0/15
  - 104.16.0.0/12
  - 172.64.0.0/13
  - 131.0.72.0/22
</code></pre>

<p>after applying this manifest, i can still access the loadbalancer URL from any browser! is this feature not working or perhaps I configured this incorrectly.</p>

<p>Thanks.</p>

Jeryl Cook
<p>From <a href="https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service</a>:</p>

<blockquote>
  <p>When using a Service with spec.type: LoadBalancer, you can specify the
  IP ranges that are allowed to access the load balancer by using
  spec.loadBalancerSourceRanges. This field takes a list of IP CIDR
  ranges, which Kubernetes will use to configure firewall exceptions.
  This feature is currently supported on Google Compute Engine, Google
  Kubernetes Engine, AWS Elastic Kubernetes Service, Azure Kubernetes
  Service, and IBM Cloud Kubernetes Service. This field will be ignored
  if the cloud provider does not support the feature.</p>
</blockquote>

<p>May be your cloud simply does not support it.</p>

<p>You can use other things that allow blocking by source IP, like nginx or ingress-nginx. In ingress-nginx you just specify list of allowed IPs in annotation <code>ingress.kubernetes.io/whitelist-source-range</code>. </p>

<p>If you want to go Nginx or other proxy route - don't forget to change Load Balancer Service <code>externalTrafficPolicy</code> to <code>Local</code>. Otherwise you will not see real client IPs.</p>
