IP Restriction

For example, configure this plugin on a service by making the following request:

1
2
3
$ curl -X POST http://<admin-hostname>:8001/services/<service>/plugins \
    --data "name=ip-restriction"  \
    --data "config.whitelist=54.13.21.1, 143.1.0.0/24"

<service> is the id or name of the service that this plugin configuration will target.

First, create a KongPlugin resource:

1
2
3
4
5
6
7
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: <ip-restriction-example>
config: 
  whitelist: 54.13.21.1, 143.1.0.0/24
plugin: ip-restriction

Next, apply the KongPlugin resource to a Service by annotating the Service as follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
apiVersion: v1
kind: Service
metadata:
  name: <service>
  labels:
    app: <service>
  annotations:
    konghq.com/plugins: <ip-restriction-example>
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: <service>
  selector:
    app: <service>

<service> is the id or name of the service that this plugin configuration will target.

For example, configure this plugin on a service by adding this section to your declarative configuration file:

1
2
3
4
5
plugins:
- name: ip-restriction
  service: <service>
  config: 
    whitelist: 54.13.21.1, 143.1.0.0/24

<service> is the id or name of the service that this plugin configuration will target.

Configure this plugin on a service:

1. In Konnect SaaS, select the service on the ServiceHub page.
2. Scroll down to Versions and select the version.
3. Scroll down to Plugins and click New Plugin.
4. Find and select the IP Restriction plugin.
5. Click Create.

Configure this plugin on a service:

1. In Kong Manager, select the workspace.
2. From the Dashboard, scroll down to Services and click View for the service row.
3. Scroll down to plugins and click Add Plugin.

4. Find and select the IP Restriction plugin.

   Note: If the plugin is greyed out, then it is not available for your product tier. See Kong Gateway tiers.
5. If the option is available, select Scoped.
6. Add the service name and ID to the Service field if it is not already prefilled.
7. Click Create.

For example, configure this plugin on a route with:

1
2
3
$ curl -X POST http://<admin-hostname>:8001/routes/<route>/plugins \
    --data "name=ip-restriction"  \
    --data "config.whitelist=54.13.21.1, 143.1.0.0/24"

<route> is the id or name of the route that this plugin configuration will target.

First, create a KongPlugin resource:

1
2
3
4
5
6
7
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: <ip-restriction-example>
config: 
  whitelist: 54.13.21.1, 143.1.0.0/24
plugin: ip-restriction

Then, apply it to an ingress (Route or Routes) by annotating the ingress as follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
apiVersion: networking/v1beta1
kind: Ingress
metadata:
  name: <route>
  annotations:
    kubernetes.io/ingress.class: kong
    konghq.com/plugins: <ip-restriction-example>
spec:
  rules:
  - host: examplehostname.com
    http:
      paths:
      - path: /bar
        backend:
          serviceName: echo
          servicePort: 80

<route> is the id or name of the route that this plugin configuration will target.

For example, configure this plugin on a route by adding this section to your declarative configuration file:

1
2
3
4
5
plugins:
- name: ip-restriction
  route: <route>
  config: 
    whitelist: 54.13.21.1, 143.1.0.0/24

<route> is the id or name of the route that this plugin configuration will target.

Configure this plugin on a route:

1. In Konnect SaaS, select the service from the ServiceHub page.
2. Scroll down to Versions and select the version.
3. Select the route.
4. Scroll down to Plugins and click Add Plugin.
5. Find and select the IP Restriction plugin.
6. Click Create.

Configure this plugin on a route:

1. In Kong Manager, select the workspace.
2. From the Dashboard, select Routes in the left navigation.
3. Click View for the route row.
4. Scroll down to plugins and click Add Plugin.

5. Find and select the IP Restriction plugin.

   Note: If the plugin is greyed out, then it is not available for your product tier. See Kong Gateway tiers.
6. If the option is available, select Scoped.
7. Add the Route ID if it is not already prefilled.
8. Click Create.

For example, configure this plugin on a consumer with:

1
2
3
$ curl -X POST http://<admin-hostname>:8001/consumers/<consumer>/plugins \
    --data "name=ip-restriction"  \
    --data "config.whitelist=54.13.21.1, 143.1.0.0/24"

<consumer> is the id or username of the consumer that this plugin configuration will target.

You can combine consumer.id, service.id, or route.id in the same request, to further narrow the scope of the plugin.

First, create a KongPlugin resource:

1
2
3
4
5
6
7
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: <ip-restriction-example>
config: 
  whitelist: 54.13.21.1, 143.1.0.0/24
plugin: ip-restriction

Then, apply it to a consumer by annotating the KongConsumer resource as follows:

1
2
3
4
5
6
7
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: <consumer>
  annotations:
    konghq.com/plugins: <ip-restriction-example>
    kubernetes.io/ingress.class: kong

<consumer> is the id or username of the consumer that this plugin configuration will target.

For example, configure this plugin on a consumer by adding this section to your declarative configuration file:

1
2
3
4
5
plugins:
- name: ip-restriction
  consumer: <consumer>
  config: 
    whitelist: 54.13.21.1, 143.1.0.0/24

<consumer> is the id or username of the consumer that this plugin configuration will target.

Configure this plugin on a consumer:

1. In Kong Manager, select the workspace.
2. From the Dashboard, scroll down to Consumers and click View for the consumer row.
3. Select the Plugins tab.
4. Click Add Plugin.

5. Find and select the IP Restriction plugin.

   Note: If the plugin is greyed out, then it is not available for your product tier. See Kong Gateway tiers.
6. If the option is available, select Global.
7. Click Create.

For example, configure this plugin globally with:

1
2
3
$ curl -X POST http://<admin-hostname>:8001/plugins/ \
    --data "name=ip-restriction"  \
    --data "config.whitelist=54.13.21.1, 143.1.0.0/24"

Create a KongClusterPlugin resource and label it as global:

1
2
3
4
5
6
7
8
9
10
11
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: <global-ip-restriction>
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: \"true\"
config: 
  whitelist: 54.13.21.1, 143.1.0.0/24
plugin: ip-restriction

For example, configure this plugin using the plugins: entry in the declarative configuration file:

1
2
3
4
plugins:
- name: ip-restriction
  config: 
    whitelist: 54.13.21.1, 143.1.0.0/24

Configure this plugin globally:

1. In Kong Manager, select the workspace.
2. From the Dashboard, select Plugins in the left navigation.
3. Click New Plugin.

4. Find and select the IP Restriction plugin.

   Note: If the plugin is greyed out, then it is not available for your product tier. See Kong Gateway tiers.
5. If the option is available, set the plugin scope to Global.
6. Click Create.