infinispan / infinispan/infinispan-operator
Add support for IP/CIDR whitelisting of the incoming traffic
- Dominant language
- Go
- Stars
- 58
- Forks
- 54
- Avg merge
- 13h 46m
- Merged PRs (30d)
- 15
Description
Hi,
As an endpoint can be exposed towards the internet it is nice to be able to limit the access to a set of IPs and CIDRs. There are few expose types within ISPN operator configuration and hopefully all support IP whitelisting.
e.g. for the LoadBalancer It could be done by adding `loadBalancerSourceRanges` to the External Service definition (works in EKS, [AKS](https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard#restrict-inbound-traffic-to-specific-ip-ranges), GCP and likely OC.
It used to be an easier option of using the annotation `service.beta.kubernetes.io/load-balancer-source-ranges` but it seem to be [deprecated now](https://kubernetes.io/docs/reference/labels-annotations-taints/#service-beta-kubernetes-io-load-balancer-source-ranges) and a recommendation is to use the spec.loadBalancerSourceRanges on the Service resource instead.
Does it makes sense to add feature like this?
Thanks,
Andrey
Contributor guide
Research direction
Start by reviewing how the operator configures its expose types and generates the external Service. Check Kubernetes Service support for spec.loadBalancerSourceRanges and determine how IP/CIDR restrictions should apply across the supported expose types. Done means the relevant Services enforce the configured allowlist and tests cover the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100