Spike: Ingest shared IP ranges groups / files into Ingress

[digitalali-moj]

Service name

LAA-IP-allowlist

Service environment

• [] Dev / Development
• [] Staging
• Prod / Production
• Other

Impact on the service

None

Problem description

We need a way to easily add groups of shared IP addresses into Ingress without teams duplicating effort and copying lists of IP ranges. The proposed solution is to do a spike on how we can easily pull in shared text file into Ingress without manually calling the scripts to read files. See: https://github.com/ministryofjustice/laa-ip-allowlist. The solution can also potentially be used for Pingdom ranges.

Contact person

Jav, [email protected]

[jaskaransarkaria]

We do not offer a central solution for this it must be managed at each ingress level, similar to the method used here. If you want to prevent duplication I would encourage packaging your applications in a helm chart where you can centrally manage the IP whitelist range.

hmpps have a similar solution but instead of passing in the whitelist as a variable you could set the values for all users who use the helm chart https://github.com/ministryofjustice/hmpps-helm-charts/blob/932117a012841b1488aa7dccf6992fc815a0a1f2/charts/generic-service/templates/ingress.yaml#L18C1-L18C30