title: Ingress ip whitelisting on load balancer - aws k8s
body: <p>I am trying to use the Security group to allow https traffic only from a particular IP. I have created the Ingress Service and resource. (ref: <a href="https://kubernetes.github.io/ingress-nginx/deploy/#aws" rel="nofollow noreferrer">NGINX Controller</a></p>
  
  <p>I tried configuring below on Ingress Service. </p>
  
  <pre><code>kind: Service
  apiVersion: v1
  metadata:
    name: ingress-nginx
    namespace: ingress-nginx
    labels:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {cert}
      # the backend instances are HTTP
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
      # Map port 443
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
      service.beta.kubernetes.io/aws-load-balancer-extra-security-groups: {SG Allowing ingres from IP}
  spec:
    type: LoadBalancer
    selector:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
    ports:
      - name: http
        port: 80
        targetPort: http
      - name: https
        port: 443
        targetPort: http
  </code></pre>
  
  <p>I tried below on resource as well.</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: test-ingress
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-extra-security-groups: {SG Allowing ingres from IP}
      ingress.kubernetes.io/whitelist-source-range: "IP"
  spec:
    rules:
    - host: test.com
      http:
        paths:
        - backend:
            serviceName: backend
            servicePort: 8080
          path: /
  </code></pre>
  
  <p>What am I missing?</p>
  
  <p>I see auto-generated SG on load balancer which allows all inbound traffic. But I'm not sure if its created by service or resource. And if its ok to edit that directly. </p>
  
  <p><strong>Update:</strong>
  Autogenerated SG
  <a href="https://i.stack.imgur.com/v8HVU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/v8HVU.png" alt="enter image description here"></a></p>
  
  <p>I added another SG which limits IP for ingress but doesn't get applied. </p>