Why this matters
Prevents accidental public exposure of internal services.
For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.
Prevents accidental public exposure of internal services.
Side-by-side examples engineers can pattern-match during review.
apiVersion: v1
kind: Service
spec:
type: LoadBalancer
ports: [{ port: 80 }]
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,192.168.0.0/16
spec:
tls:
- hosts: ["app.example.com"]
secretName: app-tls
rules:
- host: app.example.com
http: { paths: [...] }
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8kind: Service
spec:
type: LoadBalancerFrom the same buckets as this rule.