apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: arti-api namespace: {{ .Values.global.Category }}--{{ .Values.global.Name }}--{{ .Values.global.Type }} spec: entryPoints: - websecure routes: # Internal network gets full access - match: Host(`{{ .Values.global.Api.Url }}`) && ClientIP(`192.168.100.0/24`) kind: Rule priority: 1000 services: - name: api port: 8000 # External users only get root path - match: Host(`{{ .Values.global.Api.Url }}`) && Path(`/`) kind: Rule priority: 500 services: - name: api port: 8000 # Block all other external access - match: Host(`{{ .Values.global.Api.Url }}`) kind: Rule priority: 100 services: - name: blocked-service port: 80 tls: certResolver: letsencrypt --- # Service for blocked requests apiVersion: v1 kind: Service metadata: name: blocked-service namespace: {{ .Values.global.Category }}--{{ .Values.global.Name }}--{{ .Values.global.Type }} spec: selector: app: blocked-nginx ports: - port: 80 targetPort: 80 --- apiVersion: apps/v1 kind: Deployment metadata: name: blocked-nginx namespace: {{ .Values.global.Category }}--{{ .Values.global.Name }}--{{ .Values.global.Type }} spec: replicas: 1 selector: matchLabels: app: blocked-nginx template: metadata: labels: app: blocked-nginx spec: containers: - name: nginx image: nginx:alpine ports: - containerPort: 80 volumeMounts: - name: nginx-config mountPath: /etc/nginx/conf.d - name: nginx-html mountPath: /usr/share/nginx/html volumes: - name: nginx-config configMap: name: blocked-nginx-config - name: nginx-html configMap: name: blocked-nginx-html --- apiVersion: v1 kind: ConfigMap metadata: name: blocked-nginx-config namespace: {{ .Values.global.Category }}--{{ .Values.global.Name }}--{{ .Values.global.Type }} data: default.conf: | server { listen 80; server_name _; root /usr/share/nginx/html; index index.html; location / { try_files $uri $uri/ /index.html; } # Ensure all requests serve the index.html error_page 404 /index.html; } --- apiVersion: v1 kind: ConfigMap metadata: name: blocked-nginx-html namespace: {{ .Values.global.Category }}--{{ .Values.global.Name }}--{{ .Values.global.Type }} data: index.html: | Access Denied - Artifactory
403
Access Denied
This endpoint is only accessible from the internal network.