Deploy a Policy for access control

This topic describes how to use F5 NGINX Ingress Controller to apply and update a Policy for access control. It demonstrates it using an example application and a VirtualServer custom resource.

Before you begin

You should have a working NGINX Ingress Controller instance.

For ease of use in shell commands, set two shell variables:

  1. The public IP address for your NGINX Ingress Controller instance.
IC_IP=<ip-address>
  1. The HTTP port of the same instance.
IC_HTTP_PORT=<port number>

Deploy the example application

Create the file webapp.yaml with the following contents:

/webapp_6642516566950503625.yaml

Apply it using kubectl:

kubectl apply -f webapp.yaml

Deploy a Policy to create a deny rule

Create a file named access-control-policy-deny.yaml. The highlighted deny field will be used by the example application, and should be changed to the subnet of your machine.

/access-control-policy-deny_6406539143738135081.yaml

Apply the policy:

kubectl apply -f access-control-policy-deny.yaml

Configure load balancing

Create a file named virtual-server.yaml for the VirtualServer resource. The policies field references the access control Policy created in the previous section.

/virtual-server_10292496036157374013.yaml

Apply the policy:

kubectl apply -f virtual-server.yaml

Test the example application

Use curl to attempt to access the application:

curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
</body>
</html>

The 403 response is expected, successfully blocking your machine.

Update the Policy to create an allow rule

Update the Policy with the file access-control-policy-allow.yaml, setting the allow field to the subnet of your machine.

/access-control-policy-allow_13623911874850598381.yaml

Apply the Policy:

kubectl apply -f access-control-policy-allow.yaml

Verify the Policy update

Attempt to access the application again:

curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT
Server address: 10.64.0.13:8080
Server name: webapp-5cbbc7bd78-wf85w

The successful response demonstrates that the policy has been updated.