# IP Whitelist Plugin Example for Kubernetes
#
# This example demonstrates restricting access to specific IP addresses
#
# Prerequisites:
# 1. EasyHAProxy installed in your cluster
#
# 2. Update the allowed_ips annotation with your actual IP addresses/networks
#
# 3. Apply this manifest:
#    kubectl apply -f ip-whitelist.yml
#
# 4. Test from allowed IP:
#    curl http://admin.example.local/
#    # Response: Success (200 OK)
#
# 5. Test from non-allowed IP:
#    # Response: HTTP 403 Forbidden
#
# Note: Update the allowed_ips annotation with your actual office/VPN IPs

---
apiVersion: v1
kind: Service
metadata:
  name: admin-service
  namespace: default
spec:
  ports:
  - port: 8080
    targetPort: 8080
  selector:
    app: admin
  type: ClusterIP

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: admin
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: admin
  template:
    metadata:
      labels:
        app: admin
    spec:
      containers:
      - name: admin
        image: byjg/static-httpserver
        ports:
        - containerPort: 8080
        env:
        - name: TITLE
          value: "Admin Panel - IP Restricted"
        resources:
          limits:
            cpu: '0.1'
            memory: '64Mi'
          requests:
            cpu: '0.05'
            memory: '32Mi'

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: easyhaproxy-ingress

    # Enable IP whitelist plugin
    easyhaproxy.plugins: "ip_whitelist"

    # Allow specific IPs and networks
    # UPDATE THIS with your actual office/VPN IPs!
    easyhaproxy.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,198.51.100.42,10.0.0.0/8"

    # Status code to return for blocked IPs
    easyhaproxy.plugin.ip_whitelist.status_code: "403"
  name: admin-ingress-whitelist
  namespace: default
spec:
  rules:
  - host: admin.example.local
    http:
      paths:
      - backend:
          service:
            name: admin-service
            port:
              number: 8080
        pathType: ImplementationSpecific