title: Kubernetes whitelist-source-range blocks instead of whitelist IP
body: <p>Running Kubernetes on GKE</p>
  
  <p>Installed Nginx controller with latest stable release by using helm.</p>
  
  <p>Everythings works well, except adding the whitelist-source-range annotation results in that I'm completely locked out from my service.</p>
  
  <p>Ingress config</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: staging-ingress
    namespace: staging
    annotations:
      kubernetes.io/ingress.class: nginx
      ingress.kubernetes.io/whitelist-source-range: "x.x.x.x, y.y.y.y"
  spec:
    rules:
      - host: staging.com
        http:
          paths:
          - path: /
            backend:
              serviceName:staging-service
              servicePort: 80
  </code></pre>
  
  <p>I connected to the controller pod and checked the nginx config and found this:</p>
  
  <pre><code># Deny for staging.com/
  geo $the_real_ip $deny_5b3266e9d666401cb7ac676a73d8d5ae {
      default 1;
  
      x.x.x.x 0;
      y.y.y.y 0;
  }
  </code></pre>
  
  <p>It looks like he is locking me out instead of whitelist this IP's. But it also locking out all other addresses... I get 403 by going from staging.com host.</p>