<p>Is there a way to protect endpoints from public access and/or only a list of IPs to have access to it like on nginx-ingress-controller (NLB) with the snippet-server annotation?</p>

<p>Thanks</p>

Rodrigo Andrade
<p>Nginx-ingress has annotation <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#whitelist-source-range" rel="noreferrer">whitelist-source-range</a></p>

<blockquote>
  <p>You can specify allowed client IP source ranges through the <code>nginx.ingress.kubernetes.io/whitelist-source-range</code> annotation. The value is a comma separated list of <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing" rel="noreferrer">CIDRs</a>, e.g. <code>10.0.0.0/24,172.10.0.1</code>.</p>
</blockquote>

<p>For access control in LoadBalancer you could use following annotation:
<code>alb.ingress.kubernetes.io/inbound-cidrs</code></p>

<blockquote>
  <p>specifies the CIDRs that are allowed to access LoadBalancer.</p>
</blockquote>

<p>Example:</p>

<pre><code>alb.ingress.kubernetes.io/inbound-cidrs: 10.0.0.0/24
</code></pre>

<p><strong>this annotation will be ignored if  <code>alb.ingress.kubernetes.io/security-groups</code>  is specified.</strong></p>

<p>Also <a href="https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/ingress/annotation/#security-groups" rel="noreferrer"><code>alb.ingress.kubernetes.io/security-groups</code></a> which  specifies the securityGroups you want to attach to LoadBalancer.</p>

<blockquote>
  <p>When this annotation is not present, the controller will automatically create 2 security groups: the first security group will be attached to the LoadBalancer and allow access from <a href="https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/ingress/annotation/#inbound-cidrs" rel="noreferrer"><code>inbound-cidrs</code></a> to the <a href="https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/ingress/annotation/#listen-ports" rel="noreferrer"><code>listen-ports</code></a>. The second security group will be attached to the EC2 instance(s) and allow all TCP traffic from the first security group created for the LoadBalancer.</p>
</blockquote>

<p>Example:</p>

<pre><code>alb.ingress.kubernetes.io/security-groups: sg-xxxx, nameOfSg1, nameOfSg2
</code></pre>
