Kubernetes - Internal only API Endpoints Hypothetical question.

Say we have a Java application running in a Kubernetes pod (single docker container) that has 'public' endpoints and 'internal' endpoints. 

The /public endpoints should be accessible from public internet and exposed via the Ingress.

The /internal endpoints should only be accessible to other pods in the Kubernetes cluster.

Is there any way we can limit access to these /internal endpoints in 'vanilla' Kubernetes? One way I guess would to be declare the public endpoints in the ingress but them seems messy. 

I also believe tools like Istio allow policy based access?
I'm not sure I understand why listing the public endpoints in the ingress is messy. The common solution is to list the ingress endpoints in the ingress controller.

As you mentioned, there are alternatives such as Istio, Consul and other network policy solutions. There's also the Open Policy Agent that can help with this, if you don't want to write YAML.