Does ExternalName service act as a reverse proxy?

user_5021151 0
Viewed 361

I have the following need: There is API that may be accessed only from allowlisted IPs. I'd like to make this API available publicly. I thought about the following solution:

  1. Create a service of type ServiceName:
kind: Service
apiVersion: v1
metadata:
  name: my-svc
spec:
  type: ExternalName
  externalName: restricted-api.com
  1. Create an ingress:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
    - hosts:
        - mysite.com
      secretName: mysite-tls
  rules:
    - host: example.com
      http:
        paths:
          - path: /api(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: my-svc
                port:
                  name: https

Is my understanding correct that with such a setup when I call https://example.com/request on K8s level the request will be sent to https://restricted-api.com/request? The caller would not know that there is communication with restricted-api.com. Since the clients' IPs are dynamic the restricted-api.com would not allow them to call it. The k8s IP is static and I could allowlist it.

kubernetes-ingress kubernetes
1 Answers

Ok, if these are just your thoughts, I would recommend to look into this annotation:

externalTrafficPolicy=local is an annotation on the Kubernetes service resource that can be set to preserve the client source IP. When this value is set, the actual IP address of a client (e.g., a browser or mobile application) is propagated to the Kubernetes service instead of the IP address of the node.

For more information you can find here or in official Kubernetes docs.

Feel free to reach me out again, if you start to realize your thoughts and will face any issue with this.

user_168605420
Related