f75cb8aab2
- Introduced multiple detailed plugin examples for Cloudflare IP restoration, IP whitelisting, JWT validation, and combined usage. - Added configurations for `docker-compose`, `Kubernetes`, and `Swarm` showcasing individual and multi-plugin use cases. - Included clear prerequisites, setup steps, and testing procedures for each example. - Documented advanced scenarios like path blocking, custom IP lists, and JWT validation for production environments.
96 lines
2.1 KiB
YAML
96 lines
2.1 KiB
YAML
# IP Whitelist Plugin Example for Kubernetes
|
|
#
|
|
# This example demonstrates restricting access to specific IP addresses
|
|
#
|
|
# Prerequisites:
|
|
# 1. EasyHAProxy installed in your cluster
|
|
#
|
|
# 2. Update the allowed_ips annotation with your actual IP addresses/networks
|
|
#
|
|
# 3. Apply this manifest:
|
|
# kubectl apply -f ip-whitelist.yml
|
|
#
|
|
# 4. Test from allowed IP:
|
|
# curl http://admin.example.local/
|
|
# # Response: Success (200 OK)
|
|
#
|
|
# 5. Test from non-allowed IP:
|
|
# # Response: HTTP 403 Forbidden
|
|
#
|
|
# Note: Update the allowed_ips annotation with your actual office/VPN IPs
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: admin-service
|
|
namespace: default
|
|
spec:
|
|
ports:
|
|
- port: 8080
|
|
targetPort: 8080
|
|
selector:
|
|
app: admin
|
|
type: ClusterIP
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: admin
|
|
namespace: default
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: admin
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: admin
|
|
spec:
|
|
containers:
|
|
- name: admin
|
|
image: byjg/static-httpserver
|
|
ports:
|
|
- containerPort: 8080
|
|
env:
|
|
- name: TITLE
|
|
value: "Admin Panel - IP Restricted"
|
|
resources:
|
|
limits:
|
|
cpu: '0.1'
|
|
memory: '64Mi'
|
|
requests:
|
|
cpu: '0.05'
|
|
memory: '32Mi'
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
annotations:
|
|
kubernetes.io/ingress.class: easyhaproxy-ingress
|
|
|
|
# Enable IP whitelist plugin
|
|
easyhaproxy.plugins: "ip_whitelist"
|
|
|
|
# Allow specific IPs and networks
|
|
# UPDATE THIS with your actual office/VPN IPs!
|
|
easyhaproxy.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,198.51.100.42,10.0.0.0/8"
|
|
|
|
# Status code to return for blocked IPs
|
|
easyhaproxy.plugin.ip_whitelist.status_code: "403"
|
|
name: admin-ingress-whitelist
|
|
namespace: default
|
|
spec:
|
|
rules:
|
|
- host: admin.example.local
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: admin-service
|
|
port:
|
|
number: 8080
|
|
pathType: ImplementationSpecific
|