I would like to add a check to Istio to ensure that the source IP address is my load balancer. While not fool proof, I think it would make it more difficult for a attacker to spoof my proxy (where my ssl terminates).
But I can't seem to find a way to do it. I tried adding an
AuthorizationPolicy with either an
remoteIpBlocks. But neither work (I am always blocked).
When I run the httpbin sample, the X-Forward-For does not show my Loadbalancer's IP Address. It shows my pc, and an cluster IP (that I can't seem to find what service/pod it goes to).
Here is an example of my
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: ingress-policy namespace: istio-testing spec: action: ALLOW rules: - from: - source: remoteIpBlocks: - 10.60.120.200 selector: matchLabels: app: istio-ingressgateway
If I put my PC's IP address in the
remoteIpBlockslocation, then it works fine. But I don't want to block based on the calling PC, but on the loadbalancer (that is terminating the SSL and sending another call with the X-Forwarded headers).
I have also tried setting
numTrustedProxies: 1, but it seems to have no effect (for this).
How can I block all traffic to my ingress-gateway except traffic that comes from my load balancer?
Note, I am running an on-premises instance of Kubernetes. My load balancer is an F5 BigIP.