<p>I'm not sure I understand why listing the public endpoints in the ingress is messy. The common solution is to list the ingress endpoints in the ingress controller.</p>

<p>As you mentioned, there are alternatives such as Istio, Consul and other network policy solutions. There's also the Open Policy Agent that can help with this, if you don't want to write YAML.</p>

CC BY-SA 4.0
2018-10-31T02:57:46.183Z
2018-10-31T02:57:46.183Z
marcc
<p>Hypothetical question.</p>

<p>Say we have a Java application running in a Kubernetes pod (single docker container) that has 'public' endpoints and 'internal' endpoints. </p>

<p>The <code>/public</code> endpoints should be accessible from public internet and exposed via the Ingress.</p>

<p>The <code>/internal</code> endpoints should only be accessible to other pods in the Kubernetes cluster.</p>

<p>Is there any way we can limit access to these <code>/internal</code> endpoints in 'vanilla' Kubernetes? One way I guess would to be declare the public endpoints in the ingress but them seems messy. </p>

<p>I also believe tools like Istio allow policy based access?</p>

<kubernetes><istio>
Kubernetes - Internal only API Endpoints
Caledonia91
# Kubernetes - Internal only API Endpoints

(Asked by: username_0 on 2018-09-10)

Hypothetical question.

Say we have a Java application running in a Kubernetes pod (single docker container) that has 'public' endpoints and 'internal' endpoints.

The `/public` endpoints should be accessible from public internet and exposed via the Ingress.

The `/internal` endpoints should only be accessible to other pods in the Kubernetes cluster.

Is there any way we can limit access to these `/internal` endpoints in 'vanilla' Kubernetes? One way I guess would to be declare the public endpoints in the ingress but them seems messy.

I also believe tools like Istio allow policy based access?

**Tags:** kubernetes, istio


---

## 1 answers

### Answer by username_1 on 2018-10-31. Score: 2

I'm not sure I understand why listing the public endpoints in the ingress is messy. The common solution is to list the ingress endpoints in the ingress controller.

As you mentioned, there are alternatives such as Istio, Consul and other network policy solutions. There's also the Open Policy Agent that can help with this, if you don't want to write YAML.


---

