EKS集群NLB配置白名单访问

1.nlb配置

添加显示源ip字段

#添加配置（保留访问源ip）
externalTrafficPolicy: Local

此配置，在后端“多副本数”业务时会导致负载不均衡，但是若须配置白名单，则为必须前提！！

示例：

kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  annotations:
    # by default the type is elb (classic load balancer).
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
  # this setting is to make sure the source IP address is preserved.
  externalTrafficPolicy: Local
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: https

2.对应业务的ingress添加白名单

添加白名单列表（支持网段,ip地址逗号分隔）

nginx.ingress.kubernetes.io/whitelist-source-range: 'x.x.x.x/24,x.x.x.x'

ingress优先级比nlb高，只在单独ingress生效

示例：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: grafana-ingress
  namespace: grafana
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/whitelist-source-range: 'x.x.x.x/24,x.x.x.x'
spec:
  rules:
  - host: grafana.da-e.top
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: grafana-svc
            port:
              number: 80