Configuring an Access Policy for a Service

Overview

You can add IP addresses to a trustlist or blocklist to control access to a load balancer associated with the Service.

• Trustlist: Only the IP addresses in the trustlist can access the load balancer.
• Blocklist: IP addresses in the blocklist are not allowed to access the load balancer.

Prerequisites

IP address groups have been created on the ELB console. For details, see Creating an IP Address Group.

Configuring an Access policy

1. Log in to the CCI 2.0 console.
2. In the navigation pane, choose Services. On the right of the page, click Create from YAML.
3. Import or create a YAML file. For details about the parameters, see Table 1.

   The following are example files in different formats:

   • Resource description in the Service.yaml file

     apiVersion: cci/v2
     kind: Service
     metadata:
       name: kubectl-test
       namespace: kubectl
       annotations:
         kubernetes.io/elb.class: elb
         kubernetes.io/elb.id: 1234567890 # Load balancer ID. Only dedicated load balancers are supported.
         kubernetes.io/elb.acl-id: <your_acl_id>               # ID of an IP address group for accessing the load balancer
         kubernetes.io/elb.acl-type: 'white'                   # Trustlist for access control
     spec:
       selector:
         app: kubectl-test
       ports:
         - name: service-0
           targetPort: 80   # Container port
           port: 12222      # Access port
           protocol: TCP    # Protocol used to access the workload
       type: LoadBalancer

   • Resource description in the Service.json file

     {
     	"apiVersion": "cci/v2",
     	"kind": "Service",
     	"metadata": {
     		"name": "kubectl-test",
     		"namespace": "kubectl",
     		"annotations": {
                             "kubernetes.io/elb.class": "elb"
     			"kubernetes.io/elb.id": "1234567890"  # Load balancer ID. Only dedicated load balancers are supported.
                             kubernetes.io/elb.acl-id: <your_acl_id>               # ID of an IP address group for accessing the load balancer                        
                             "kubernetes.io/elb.acl-type": "white"                   # Trustlist for access control
     		}
     	},
     	"spec": {
     		"selector": {
     			"app": "kubectl-test"
     		},
     		"ports": [
     			{
     				"name": "service-0",
     				"targetPort": 80,     # Container port
     				"port": 12222,        # Access port
     				"protocol": "TCP",    #Protocol used to access the workload
     				"type": "LoadBalancer"
     			}
     		]
     	}
     }

4. Click OK. Access the workload through the load balancer's IP address and port in the format of <IP-address>:<port>.
   • If a trustlist is used for access control, only the IP addresses in the trustlist can access the load balancer.
   • If a blocklist is used for access control, the IP addresses in the blocklist cannot access the load balancer.