Help Center/ Cloud Container Engine/ User Guide/ Network/ Ingresses/ LoadBalancer Ingresses/ Advanced Setting Examples of LoadBalancer Ingresses/ Configuring a Blocklist/Trustlist Access Policy for a LoadBalancer Ingress
Updated on 2024-09-30 GMT+08:00
View PDF
Share

Configuring a Blocklist/Trustlist Access Policy for a LoadBalancer Ingress

You can add IP addresses to a trustlist or blocklist to control access to a listener of a LoadBalancer ingress.

  • Trustlist: Only the IP addresses in the list can access the listener.
  • Blocklist: The IP addresses in the list are not allowed to access the listener.

After a blocklist/trustlist access policy is configured, if you delete the blocklist/trustlist access policy configuration on the CCE console or delete the target annotation from the YAML file, the configuration on the ELB will be retained.

Prerequisites

  • A Kubernetes cluster is available and the cluster version meets the following requirements:
    • v1.23: v1.23.12-r0 or later
    • v1.25: v1.25.7-r0 or later
    • v1.27: v1.27.4-r0 or later
    • v1.28: v1.28.2-r0 or later
    • Other clusters of later versions
  • An IP address group has been created on the ELB console. For details, see Creating an IP Address Group.

Configuring a Blocklist/Trustlist Access Policy

You can configure a blocklist/trustlist access policy for an ingress using either the CCE console or kubectl.

  1. Log in to the CCE console and click the cluster name to access the cluster console.
  2. Choose Services & Ingresses in the navigation pane, click the Ingresses tab, and click Create Ingress in the upper right corner.
  3. Configure ingress parameters.

    This example explains only key parameters for configuring blocklist/trustlist access policies. You can configure other parameters as required. For details, see Creating a LoadBalancer Ingress on the Console.

    Table 1 Key parameters

    Parameter

    Description

    Example

    Name

    Enter an ingress name.

    ingress-test

    Load Balancer

    Select a load balancer to be associated with the ingress or automatically create a load balancer. A load balancer can be dedicated or shared.

    Dedicated

    Listener
    • External Protocol: HTTP and HTTPS are available.
    • External Port: specifies the port of the load balancer listener.
    • Access Control
      • Allow all IP addresses: No access control is configured.
      • Trustlist: Only the selected IP address group can access the load balancer.
      • Blocklist: The selected IP address group cannot access the load balancer.
    • External Protocol: HTTP
    • External Port: 80
    • Advanced Options

      Access Control: Blocklist

    Forwarding Policy
    • Domain Name: Enter an actual domain name to be accessed. If it is left blank, the ingress can be accessed through the IP address. Ensure that the domain name has been registered and licensed. Once a forwarding policy is configured with a domain name specified, you must use the domain name for access.
    • Path Matching Rule: Select Prefix match, Exact match, or RegEx match.
    • Path: Enter the path provided by a backend application for external access. The path added must be valid in the backend application, or the forwarding cannot take effect.
    • Destination Service: Select an existing Service or create a Service. Any Services that do not match the search criteria will be filtered out automatically.
    • Destination Service Port: Select the access port of the destination Service.
    • Domain Name: You do not need to configure this parameter.
    • Path Matching Rule: Prefix match
    • Path: /
    • Destination Service: nginx
    • Destination Service Port: 80
    Figure 1 Configuring a blocklist/trustlist access policy

  4. Click OK.
  1. Use kubectl to access the cluster. For details, see Connecting to a Cluster Using kubectl.
  2. Create a YAML file named ingress-test.yaml. The file name can be customized. 

    vi ingress-test.yaml
    An example YAML file of an ingress created using an existing load balancer is as follows: 
    apiVersion: networking.k8s.io/v1
kind: Ingress 
metadata: 
  name: ingress-test
  annotations: 
    kubernetes.io/elb.id: <your_elb_id>                    # Load balancer ID. Replace it with the actual value.
    kubernetes.io/elb.class: performance                   # Load balancer type
    kubernetes.io/elb.port: '80'                           # External port of the load balancer listener
    kubernetes.io/elb.acl-id: <your_acl_id>               # ID of an IP address group for accessing a load balancer
    kubernetes.io/elb.acl-status: 'on'                    # Enable access control.
    kubernetes.io/elb.acl-type: 'white'                   # Trustlist for access control
spec:
  rules: 
  - host: ''
    http: 
      paths: 
      - path: '/'
        backend: 
          service:
            name: <your_service_name>  # Replace it with the name of your target Service.
            port: 
              number: 80             # Replace 80 with the port number of your target Service.
        property:
          ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
        pathType: ImplementationSpecific
  ingressClassName: cce
    Table 2 Annotations for ELB access control

    Parameter

    Type

    Description

    kubernetes.io/elb.acl-id

    String
    • If this parameter is not specified, CCE does not modify access control on the ELB.
    • If this parameter is left empty, all IP addresses are allowed to access the load balancer.
    • If this parameter is set to the IP address group ID of the load balancer, access control is enabled and you need to configure an IP address blocklist or trustlist for the load balancer. Additionally, you need to configure both kubernetes.io/elb.acl-status and kubernetes.io/elb.acl-type.

      How to obtain:

      Log in to the console. In the Service List, choose Networking > Elastic Load Balance. On the Network Console, choose Elastic Load Balance > IP Address Groups and copy the ID of the target IP address group. For details, see Creating an IP Address Group.

    kubernetes.io/elb.acl-status

    String

    This parameter is mandatory when you configure an IP address blocklist or trustlist for a load balancer. Options:

    • on: Access control is enabled.
    • off: Access control is disabled.

    kubernetes.io/elb.acl-type

    String

    This parameter is mandatory when you configure an IP address blocklist or trustlist for a load balancer. Options:

    • black: indicates a blocklist. The selected IP address group cannot access the load balancer.
    • white: indicates a trustlist. Only the selected IP address group can access the load balancer.

  3. Create an ingress. 

    kubectl create -f ingress-test.yaml

    If information similar to the following is displayed, the ingress has been created:

    ingress/ingress-test created

  4. Check the created ingress. 

    kubectl get ingress

    If information similar to the following is displayed, the ingress has been created:

    NAME          CLASS    HOSTS     ADDRESS          PORTS   AGE
ingress-test  cce      *         121.**.**.**     80      10s

Parent Topic: Advanced Setting Examples of LoadBalancer Ingresses