Istio Ingress IP whitelisting

Networking
13

@romachalm.

I am trying exactly the same thing. I have the following config as a starter

apiVersion: config.istio.io/v1alpha2
kind: handler
metadata:
  name: blacklistip
spec:
  compiledAdapter: listchecker

  params:
    providerUrl: http://urlist.com/ip.txt
    overrides: ["0.0.0.0.25"]
    blacklist: true
    entryType: IP_ADDRESSES
---
apiVersion: config.istio.io/v1alpha2
kind: instance
metadata:
  name: sourceip-blacklist
spec:
  compiledTemplate: listentry
  params:
    value: source.ip | ip("0.0.0.0")
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: checkip-whitelist
spec:
  match: source.labels["istio"] == "ingressgateway"
  actions:
  - handler: blacklistip
    instances: [ sourceip-blacklist ]

What parameter do i need to set in the handler? Could you help me out. I have already set externalTrafficPolicy to Local for the istio ingressgateway service.

@jaygridley. Did you get this running? Could you share me the config please if possible?

Regards,
Kevin