Nginx generating a wrong whitelist-source-range

[gianrubio]

I have 2 ingress for the same domain and apparently after PR #517 nginx generate a wrong whitelist-source-range.

apiVersion: v1
items:
- apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      ingress.kubernetes.io/whitelist-source-range: 23.135.13.124/32
      kubernetes.io/ingress.class: extern
    name: acl
    namespace: xxx
  spec:
    rules:
    - host: my.staging.eu
      http:
        paths:
        - backend:
            serviceName: default-http-backend
            servicePort: 80
          path: /health-check
- apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      ingress.kubernetes.io/whitelist-source-range: 23.135.13.124/32
      kubernetes.io/ingress.class: extern
      kubernetes.io/tls-acme: "false"
    name: xxx-extern
    namespace: xxx
  spec:
    rules:
    - host: my.staging.eu
      http:
        paths:
        - backend:
            serviceName: my_service
            servicePort: 80
          path: /
- apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
      kubernetes.io/ingress.class: extern
      kubernetes.io/tls-acme-challenge-endpoints: "true"
    generation: 1
    name: kube-lego-extern
    namespace: kube-system
  spec:
    rules:
    - host: my.staging.eu
      http:
        paths:
        - backend:
            serviceName: kube-lego-extern
            servicePort: 8080
          path: /.well-known/acme-challenge

Generated nginx.conf

   server_name my.staging.eu;
      ....

        location /health-check {
            set $proxy_upstream_name "staging-default-http-backend-80";

            allow 23.135.13.124/32;
            deny all;
...
...

   location / {
            set $proxy_upstream_name "staging-xxx-80";

            allow 0.0.0.0/0; < ====== It's wrong
            deny all;
....

[ashb]

Is 0.0.0.0/0 the default whitelist range from your config map?

[gianrubio]

No, I don't have this option in the configmap just in ingress