Comments (3)
Hi Patrick
Just to make this feature request more generic, here we want to:
- "allow" or "deny" traffic based on source IP address
- provide the list of IPs
- apply this matching either to the source IP address of the TCP connection or in any HTTP header provided by configuration
I do propose the following annotations:
ip-list
: name of a configmap where a list of IP can be foundip-list-action
: action to be perfomed: either 'allow' or 'deny'ip-list-header
: (optional) name of the HTTP header where to find the source IP address. Default is to be use the source IP from the TCP client connection
the ip-list
configmap should look like:
data:
ip-list:
- a.b.c.d
- e.f.g.h
The idea behind the config map is that we can use the list of IPs for multiple ingresses / controllers and also we can watch it and once updated, the controller can replicate the change in HAProxy at runtime (when the client-native lib will support this)
With this, we should be able to meet your needs and many other use cases.
from kubernetes-ingress.
That would be perfect, two things I forgot to specify though :
- I need to specify IP ranges (
a.b.c.d/24
for example ); - I need to specify both IPv4 & IPv6 IP addresses.
from kubernetes-ingress.
both will be supported out of the box.
I wonder one thing, I don't like the naming propositon: ip-list
but would like to rename it to filter
or filtering
. What do you think? It is closer to what it does exactly
from kubernetes-ingress.
Related Issues (20)
- questions about request headers HOT 3
- http -> https default redirect not working by default HOT 13
- Deployment yaml still point to privileged port after s6 upgrade HOT 3
- frontend tcp-514: cannot bind socket (Permission denied) for [0.0.0.0:514] HOT 2
- haproxy ingress 1.11.2 reloads when number of backend pods scales HOT 10
- When specifying a server-proto annotation the check parameter is omitted
- Using both annotations "haproxy.org/cr-backend" and "haproxy.org/<parameter>" HOT 3
- Docs: when adjusting --sync-period, must also adjust initialDelaySeconds HOT 4
- Controller restarts haproxy every 5 minutes with message "restart required : Global config updated: " HOT 4
- Docs: Add info about --job-check-crd to documentation HOT 1
- Ingress Pods Fail to Start HOT 5
- Try to understand the mode for tcpcr in 3.0.0 HOT 5
- how enable only high secure ssl ciphers in haproxy ingress? HOT 3
- change route-acl into an array so multiple ACL's can be defined here. HOT 1
- Named backend server instead of generic SRV_x name HOT 7
- Not able to setup retry-on functionality globally, I tried multiple values.yaml ! Please correct me if i am wrong ! HOT 2
- Some clarification needed for handling canary deployments HOT 3
- Runtime API changes not getting synced between haproxy replicas HOT 3
- Unable to Configure Multiple Backends on the Same Port in TCP CRD HOT 7
- Possibility to add custom stick tables HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kubernetes-ingress.