Ingress Allowlisting Controller

A Kubernetes controller that manages IP allowlisting for Ingress, Gateway API, and NetworkPolicy resources, driven by custom CIDRs / ClusterCIDRs CRDs and optional remote CIDR sources.

Features

Source	Destination	Requires
kind: Ingress	metadata.annotation: nginx.ingress.kubernetes.io/whitelist-source-range	nginx Ingress Controller
kind: Gateway	kind: AuthorizationPolicy (L4, gateway-scoped)	Gateway API + Istio
kind: HTTPRoute	kind: AuthorizationPolicy (L7, per-route)	Gateway API + Istio
kind: HTTPRoute	kind: Middleware (IPAllowList, per-route)	Gateway API + Traefik
kind: NetworkPolicy	spec.ingress[].from[].ipBlock AND/OR spec.egress[].to[].ipBlock	CNI with NetworkPolicy support (e.g. Calico, AWS VPC CNI)
kind: Service	spec.loadBalancerSourceRanges	type: LoadBalancer + a load balancer that honours source ranges

Istio and Traefik support is auto-detected at startup — no flags needed. The controller checks which CRDs are installed and registers only the relevant writers.

Installation

git clone https://github.com/adevinta/ingress-allowlisting-controller.git
cd ingress-allowlisting-controller/helm-charts/ingress-allowlisting-controller
helm install ingress-allowlisting-controller ./ --namespace ingress-allowlisting --create-namespace

Verify:

kubectl get pods -n ingress-allowlisting

Documentation

• Ingress
• Gateway API — Gateway & HTTPRoute (Istio + Traefik)
• NetworkPolicy
• Service (loadBalancerSourceRanges)
• CIDRs & ClusterCIDRs CRDs
• Security considerations
• Architecture & support matrix
• Metrics

Quick start

Define your IP ranges as a ClusterCIDRs object:

apiVersion: ipam.adevinta.com/v1alpha1
kind: ClusterCIDRs
metadata:
  name: office-ips
spec:
  cidrs:
  - 10.0.0.0/8
  - 192.168.0.0/16

Then reference it from any supported resource:

metadata:
  annotations:
    ipam.adevinta.com/cluster-allowlist-group: office-ips

The annotation value can be a comma-separated list: office-ips,partner-ips,cloudfront.

See CIDRs & ClusterCIDRs for namespace-scoped CIDRs, remote HTTP sources, and GitHub-hosted lists.