feat: ip range control#345
Conversation
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
kkk777-7
requested review from
LiorLieberman,
Stevenjin8,
robscott and
youngnick
as code owners
k8s-ci-robot
added
the
kind/feature
k8s-ci-robot
added
size/XL
|
|
||
| securityPolicy := e.getOrBuildSecurityPolicy(ctx, sectionName, idx) | ||
|
|
||
| if len(ipCon.AllowList) > 0 && len(ipCon.DenyList) > 0 { |
There was a problem hiding this comment.
do we worry about conflicts here?
There was a problem hiding this comment.
maybe, If both deny lists and allow lists exist, they can be able to coexist, with the deny list being evaluated first.
https://github.com/kubernetes/ingress-nginx/blob/main/rootfs/etc/nginx/template/nginx.tmpl#L1206-L1214
Stevenjin8
left a comment
Stevenjin8
left a comment
There was a problem hiding this comment.
@kkk777-7 seems good at a high level. Do you think you could add eg to the integration test framework? Doesn't have to be in this PR, but I think it would be good to have integration tests for every feature.
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
|
@Stevenjin8 thanks for review! |
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
|
/approve |
k8s-ci-robot
added
the
approved
|
/approve cancel |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kkk777-7, Stevenjin8 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
* feat: ip source range in ingress nginx provider Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * feat: ip source range in envoy gateway emitter Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * tweak: buffer ir handling Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: security policy spec Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update: simplify auth logic Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
* feat: ip source range in ingress nginx provider Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * feat: ip source range in envoy gateway emitter Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * tweak: buffer ir handling Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: security policy spec Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update: simplify auth logic Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
3 participants
What type of PR is this?
/kind feature
What this PR does / why we need it:
Support IP Range Control annotation in ingress nginx.
currently, Envoy Gateway GA supports IP allowlist/denylist.
https://gateway.envoyproxy.io/docs/tasks/security/restrict-ip-access/
Which issue(s) this PR fixes:
Fixes #
Does this PR introduce a user-facing change?: