<p>I have an alb ingress controller in which I don't want to allow access to certain paths from the external side. example path like actuator which is mounted to monitor services internally.</p>
<p>I see every ingress rule routing request to serve in the background. how can I return 403 from ingress itself?</p>

Rajeev
<p>This can be achieved by using annotations.</p>
<p>For example as follows:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{&quot;Type&quot;: &quot;redirect&quot;, &quot;RedirectConfig&quot;:
      { &quot;Protocol&quot;: &quot;HTTPS&quot;, &quot;Port&quot;: &quot;443&quot;, &quot;StatusCode&quot;: &quot;HTTP_301&quot;}}'
    alb.ingress.kubernetes.io/group.name: my-example-com-alb
    alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTP&quot;: 80}, {&quot;HTTPS&quot;: 443}]'
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/security-groups: my-security-group
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/ssl-policy : &quot;ELBSecurityPolicy-TLS-1-2-Ext-2018-06&quot;
    external-dns.alpha.kubernetes.io/hostname: myhost.example.com
    alb.ingress.kubernetes.io/healthcheck-path: &quot;/mycustomhealthpath/&quot;
    alb.ingress.kubernetes.io/healthcheck-protocol: &quot;HTTP&quot;
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: &quot;15&quot;
    alb.ingress.kubernetes.io/healthcheck-port: &quot;http&quot;
    alb.ingress.kubernetes.io/unhealthy-threshold-count: &quot;3&quot;
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/actions.response-403: &gt;
      {&quot;type&quot;:&quot;fixed-response&quot;,&quot;fixedResponseConfig&quot;:{&quot;contentType&quot;:&quot;text/plain&quot;,&quot;statusCode&quot;:&quot;403&quot;,&quot;messageBody&quot;:&quot;403 External access to endpoint not allowed&quot;}}
  name: login
spec:
  rules:
  - host: myhost.example.com
    http:
      paths:
      - path: /block/access/to/this/path
        backend:
          serviceName: response-403
          servicePort: use-annotation
      - backend:
          serviceName: ssl-redirect
          servicePort: use-annotation
        path: /
        pathType: ImplementationSpecific
      - backend:
          serviceName: myapp
          servicePort: http
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - myhost.example.com
</code></pre>
<p>Notice that in this example the URI and URL are fictional.</p>
<p>Reference: <a href="https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/ingress/annotations/#traffic-routing" rel="nofollow noreferrer">https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/ingress/annotations/#traffic-routing</a>.</p>
<p>In this example, the <code>apiVersion</code> of the Kubernetes ingress manifest uses the <code>extentions/v1beta1</code> API group; the example can be adapted to fit the stable API group, the convention does not change.</p>
<p>Last but not least, I did not check what is the minimum version of the ingress-controller that does support this convention. In this example, I rely on version 2.2.</p>
