Merging nnginx.ingress.kubernetes.io/whitelist-source-range annotation with global config

[iamalryz]

According to documentation, at the moment annotation nginx.ingress.kubernetes.io/whitelist-source-range totally overrides corresponding option from ConfigMap.

In my use case I want to configure trusted networks globally for all Ingress objects (by whitelist-source-range option at ConfigMap), and add another trusted IPs/networks for particular Ingress objects.

If I use annotation nginx.ingress.kubernetes.io/whitelist-source-range on particular Ingress object, I loose access to its from trusted networks configured globally.

It would be nice to have a toggle to enable merging nnginx.ingress.kubernetes.io/whitelist-source-range annotation with whitelist-source-range option from ConfigMap.

Like this:

nginx.ingress.kubernetes.io/whitelist-source-range-mode: <override|merge>

With default value of override.

I couldn't find another issues about this feature.

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[longwuyuan]

What are the nginx.conf directives that get configured for this and in which contexts

[github-actions]

This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach #ingress-nginx-dev on Kubernetes Slack.

[navesimchi]

@longwuyuan
I’m encountering the same issue using the NGINX Ingress Controller, installed via the official Helm chart (version v4.11.5).

I’ve configured a set of IP ranges in the controller’s ConfigMap using the whitelist-source-range parameter (docs).
Additionally, I specified a different set of IPs in an Ingress resource using the nginx.ingress.kubernetes.io/whitelist-source-range annotation (docs).

However, the annotation completely overrides the global ConfigMap setting instead of merging with it.

It would be really helpful to have an option to merge both sources, so that global IPs can remain defined in the controller config while Ingress-specific IPs can be added per resource. This would help keep Ingress rules slim, especially when dealing with large or varying IP allowlists.

[longwuyuan]

@navesimchi that is the current expected behavior.
Changing the behavior to merging, is a new feature and unfortunately the project is not having resources to create & maintain new features.

/close

[k8s-ci-robot]

@longwuyuan: Closing this issue.

Details

In response to this:

@navesimchi that is the current expected behavior.
Changing the behavior to merging, is a new feature and unfortunately the project is not having resources to create & maintain new features.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[navesimchi]

@longwuyuan
Is it possible to use a global variable in the controller config to simplify the annotation?

For example, if we have two global IPs (1.1.1.1/32, 2.2.2.2/32), can we define a variable like global_ips, and then in the ingress rule include a third IP (3.3.3.3/32) so the annotation would look something like:
nginx.ingress.kubernetes.io/whitelist-source-range: "$global_ips, 3.3.3.3/32"

Would that be supported?