After building a new container image in a GitHub Actions workflow, I would like to deploy it to a Kubernetes cluster (hosted in AKS) via the k8s-deploy action.
This requires the cluster to be reachable from the IP address of a GitHub-hosted runner. My cluster is not generally supposed to be reachable from the public internet.
Github has published ranges of IP addresses of GitHub-hosted runners; however, right now, these are the ranges of entire Azure regions. Thus, locking down cluster access to those IP ranges is not secure.
Is there a recommended way to add an additional layer of security which prevents cluster access from IPs inside those IP ranges, but not from a Github-hosted runner?