Ensure installers can limit ingress access from public internet

[phillipedwards]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

By default, public network access is assumed by all installers. This means the self-hosted service is open to all users much like app.pulumi.com, which is not ideal for customers. They'd likely want to restrict network access based on something like an IP range.

The ECS installer allows a config value, seen here where the user can provide a whitelist.

We should implement a similar configurable solution for all other solutions.

Because I like todo lists:

• Add ingress allow list to GKE hosted installer #105
• Add ingress whitelist to EKS hosted installer #106
• Add ingress whitelist for ingress to AKS installer #107

Affected area/feature

[pierskarsenbarg]

Just dumping this here for later: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#whitelist-source-range

[pierskarsenbarg]

@phillipedwards Are you aversed to using cloud-specific ingress methods: by that I mean we've got load balancer ingress for EKS, and there's an API Gateway ingress for AKS (although there was a limitation in CORS which is why it's not being used right now) and presumably something similar for GKE

[phillipedwards]

@pierskarsenbarg I'm not however, we should be able to limit ingress with nginx ingress for all k8s fairly easily.