title: Trying to set up an ingress with tls and open to some IPs only on GKE
body: <p>I'm having trouble setting up an ingress open only to some specific IPs, checked docs, tried a lot of stuff and an IP out of the source keep accessing. that's a Zabbix web interface on an alpine with nginx, set up a service on node-port 80 then used an ingress to set up a loadbalancer on GCP, it's all working, the web interface is working fine, but how can I make it accessible only to desired IPs? 
  my firewall rules are ok and it's only accessible through load balancer IP</p>
  
  <p>Also, I have a specific namespace for this deploy.</p>
  
  <p>Cluster version <code>1.11.5-gke.5</code> 
  <strong>EDIT</strong> i'm using GKE standard ingress GLBC</p>
  
  <p>My template is config as follow can someone help enlighten me on what is missing:</p>
  
  <pre><code>    apiVersion: v1
      kind: ReplicationController
      metadata:
        name: zabbix-web
        namespace: zabbix-prod
        labels:
          app: zabbix
          tier: frontend
      spec:
        replicas: 1
        template:
          metadata:
            labels:
              name: zabbix-web
              app: zabbix
          spec:
            volumes:
            - name: cloudsql-instance-credentials
              secret:
                defaultMode: 420
                secretName: cloudsql-instance-credentials
            containers:
              - command:
                - /cloud_sql_proxy
                - -instances=&lt;conection&gt;
                - -credential_file=/secrets/cloudsql/credentials.json
                image: gcr.io/cloudsql-docker/gce-proxy:1.11
                imagePullPolicy: IfNotPresent
                name: cloudsql-proxy
                resources: {}
                securityContext:
                  allowPrivilegeEscalation: false
                  runAsUser: 2
                terminationMessagePath: /dev/termination-log
                terminationMessagePolicy: File
                volumeMounts:
                - mountPath: /secrets/cloudsql
                  name: credentials
                  readOnly: true
              - name: zabbix-web
                image: zabbix/zabbix-web-nginx-mysql:alpine-3.2-latest
                ports:
                - containerPort: 80
                env:
                - name: MYSQL_USER
                  valueFrom:
                    secretKeyRef:
                      key: &lt;user&gt;
                      name: &lt;user&gt;
                - name: MYSQL_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      key: &lt;pass&gt;
                      name: &lt;pass&gt;
                - name: DB_SERVER_HOST
                  value: 127.0.0.1
                - name: MYSQL_DATABASE
                  value: &lt;db&gt;
                - name: ZBX_SERVER_HOST
                  value: &lt;db&gt;
              readinessProbe:
                failureThreshold: 3
                httpGet:
                  path: /index.php
                  port: 80
                  scheme: HTTP
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 30
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: "zabbix-web-service"
    namespace: "zabbix-prod"
    labels:
      app: zabbix
  spec:
    ports:
    - port: 80
      targetPort: 80
    selector:
      name: "zabbix-web"
    type: "NodePort"
  ---
  apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: zabbix-web-ingress
    namespace: zabbix-prod
    annotations:
      ingress.kubernetes.io/service.spec.externalTrafficPolicy: local
      ingress.kubernetes.io/whitelist-source-range: &lt;xxx.xxx.xxx.xxx/32&gt;
  spec:
    tls:
    - secretName: &lt;tls-cert&gt;
    backend:
      serviceName: zabbix-web-service
      servicePort: 80
  </code></pre>