title: How to set ingress-policy to allow limited IP with Istio?
body: <p>From the document <a href="https://istio.io/v1.7/docs/tasks/security/authorization/authz-ingress/" rel="nofollow noreferrer">Authorization on Ingress Gateway</a>, I set an ingress-policy as this</p>
  <pre><code>apiVersion: security.istio.io/v1beta1
  kind: AuthorizationPolicy
  metadata:
    name: ingress-policy
    namespace: istio-system
  spec:
    selector:
      matchLabels:
        app: istio-ingressgateway
    action: ALLOW
    rules:
    - from:
      - source:
         ipBlocks: [&quot;ALLOWED PUBLIC IP HERE&quot;]
  </code></pre>
  <p>I got my public IP from <a href="https://whatismyipaddress.com/" rel="nofollow noreferrer">WhatIsMyIPAddress</a>, set it in the <code>ipBlocks</code> above.</p>
  <p>After applied the manifest, when I access my site from browser, it showed <code>RBAC access denied</code>.</p>
  <p>My applications are deployed in the <code>default</code> namespace, is it correct to use <code>namespace: istio-system</code> in the metadata? And how to see the access logs for debugging?</p>
  <p>What's the right way to set an IP filter?</p>
  <p>Check Istio's ingressgateway log got</p>
  <pre><code>kubectl logs istio-ingressgateway-111111111111-aaaaa -n istio-system
  ...
  [2021-12-20T05:10:58.600Z] &quot;GET /healthz/ready HTTP/1.1&quot; 403 - rbac_access_denied_matched_policy[none] - &quot;-&quot; 0 19 0 - &quot;10.123.45.123&quot; &quot;ELB-HealthChecker/2.0&quot; &quot;11111111-aaaa-3333-cccc-555555555555&quot; &quot;10.123.45.123:30974&quot; &quot;-&quot; outbound|80||demo-service.default.svc.cluster.local - 10.123.45.123:8443 10.148.45.200:22429 - -
  [2021-12-20T05:10:58.601Z] &quot;GET /healthz/ready HTTP/1.1&quot; 403 - rbac_access_denied_matched_policy[none] - &quot;-&quot; 0 19 0 - &quot;10.123.45.200&quot; &quot;ELB-HealthChecker/2.0&quot; &quot;22222222-bbbb-4444-dddd-666666666666&quot; &quot;10.123.45.200:30974&quot; &quot;-&quot; outbound|80||demo-service.default.svc.cluster.local - 10.123.45.123:8443 10.123.45.200:15566 - -
  2021-12-20T05:29:09.478225Z     info    xdsproxy        connected to upstream XDS server: istiod.istio-system.svc:15012
  </code></pre>
  <p>Why <code>rbac_access_denied_matched_policy</code> is <code>none</code> here? I'm not using rbac in the K8s cluster. Is it necessary to use it in this case?
  <a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/rbac_filter" rel="nofollow noreferrer">Role Based Access Control (RBAC) Filter</a></p>
  <hr />
  <p>edit</p>
  <p>Got new logs from Istio's ingress gateway</p>
  <pre><code>...
  2021-12-21T03:36:41.819072Z     debug   envoy rbac      checking request: requestedServerName: , sourceIP: 10.123.45.111:25965, directRemoteIP: 10.123.45.111:25965, remoteIP: 10.123.45.111:25965,localAddress: 10.123.46.222:8443, ssl: uriSanPeerCertificate: , dnsSanPeerCertificate: , subjectPeerCertificate: , headers: ':authority', '10.123.45.111:30974'
  ':path', '/healthz/ready'
  ':method', 'GET'
  ':scheme', 'https'
  'user-agent', 'ELB-HealthChecker/2.0'
  'accept-encoding', 'gzip, compressed'
  'x-forwarded-for', '10.123.45.111'
  'x-forwarded-proto', 'https'
  'x-envoy-internal', 'true'
  'x-request-id', '123412231a-cb12-9732-859e-0213jladfsj9'
  'x-envoy-decorator-operation', 'demo-service.default.svc.cluster.local:80/*'
  , dynamicMetadata:
  2021-12-21T03:36:41.819091Z     debug   envoy rbac      enforced allowed, matched policy none
  </code></pre>