infinispan / infinispan/infinispan-operator

Add support for IP/CIDR whitelisting of the incoming traffic

Open
#2,139 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
58
Forks
54
Avg merge
13h 46m
Merged PRs (30d)
15

Description

Hi,

As an endpoint can be exposed towards the internet it is nice to be able to limit the access to a set of IPs and CIDRs. There are few expose types within ISPN operator configuration and hopefully all support IP whitelisting.

e.g. for the LoadBalancer It could be done by adding `loadBalancerSourceRanges` to the External Service definition (works in EKS, [AKS](https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard#restrict-inbound-traffic-to-specific-ip-ranges), GCP and likely OC.

It used to be an easier option of using the annotation `service.beta.kubernetes.io/load-balancer-source-ranges` but it seem to be [deprecated now](https://kubernetes.io/docs/reference/labels-annotations-taints/#service-beta-kubernetes-io-load-balancer-source-ranges) and a recommendation is to use the spec.loadBalancerSourceRanges on the Service resource instead.

Does it makes sense to add feature like this?

Thanks,
Andrey

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how the operator configures its expose types and generates the external Service. Check Kubernetes Service support for spec.loadBalancerSourceRanges and determine how IP/CIDR restrictions should apply across the supported expose types. Done means the relevant Services enforce the configured allowlist and tests cover the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
infrastructure, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.