How to do IP whitelist with KGateway

[DesmondH0]

Hi community, Thanks for creating this project and we are testing to adopt KGateway for ingress replacement.

And currently I am looking for IP Whitelist functionality.
I had been testing with RBAC in TrafficPolicy but seems the best is only able to matching single IP, example:

apiVersion: gateway.kgateway.dev/v1alpha1
kind: TrafficPolicy
metadata:
  name: rbac-poc
  namespace: poc
spec:
  targetRefs: 
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: rbac-poc-route
  rbac:
    action: Allow
    policy:
      matchExpressions:
      # source.address seems contains port info and not IP only
      - source.address.startsWith("${my_ip_here}")

From what i discover it seems do not able to match against a CIDR range.
Also the kube.service under GatewayParameters do not allow setting spec.loadBalancerSourceRanges as workaround.
Would be appreciate pointing out if i missed anything here, thanks!

[SaschaJohn]

you can add multiple startsWith

like here: https://github.com/log1cb0mb/ingress2keg/blob/1c8e1e25b4df2a54820b05bed3039161e14f1ab7/kgateway/03-kgateway-policies/02-comprehensive-test-trafficpolicy.yaml

[DesmondH0]

Thanks for the reference, but seems still not possible to match against CIDR?
Using start with could allow excessive IPs to access 🤔

[yuval-k]

Because we use server-side-apply, if you set loadBalancerSourceRanges yourself, i believe we won't override it.

I don't believe you cann't fully do a cidr in envoy, but you could approximate it: for example

source.address.startsWith("1.2.3.")

to match 1.2.3.0/24