Skip to content

Commit 8835f3a

Browse files
salonichf5salonichf5
committed
add support for preserving clientIP
1 parent 34654d7 commit 8835f3a

File tree

20 files changed

+813
-38
lines changed

20 files changed

+813
-38
lines changed

‎apis/v1alpha1/nginxproxy_types.go

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ type NginxProxySpec struct {
5353
//
5454
// +optional
5555
Telemetry *Telemetry `json:"telemetry,omitempty"`
56+
// RewriteClientIP defines configuration for rewriting the client IP to the original client's IP.
57+
// +kubebuilder:validation:XValidation:message="if mode is set, trustedAddresses is a required field",rule="!(has(self.mode) && !has(self.trustedAddresses))"
58+
//
59+
// +optional
60+
//nolint:lll
61+
RewriteClientIP *RewriteClientIP `json:"rewriteClientIP,omitempty"`
5662
// DisableHTTP2 defines if http2 should be disabled for all servers.
5763
// Default is false, meaning http2 will be enabled for all servers.
5864
//
@@ -114,3 +120,56 @@ type TelemetryExporter struct {
114120
// +kubebuilder:validation:Pattern=`^(?:http?:\/\/)?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*(?::\d{1,5})?$`
115121
Endpoint string `json:"endpoint"`
116122
}
123+
124+
// RewriteClientIP specifies the configuration for rewriting the client's IP address.
125+
type RewriteClientIP struct {
126+
// Mode defines how NGINX will rewrite the client's IP address.
127+
// Possible modes: ProxyProtocol, XForwardedFor.
128+
//
129+
// +optional
130+
Mode *RewriteClientIPModeType `json:"mode,omitempty"`
131+
132+
// SetIPRecursively configures whether recursive search is used for selecting client's
133+
// address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
134+
// If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
135+
// array to start of array and select the first untrusted IP.
136+
//
137+
// +optional
138+
SetIPRecursively *bool `json:"setIPRecursively,omitempty"`
139+
140+
// TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
141+
// If a request comes from a trusted address, NGINX will rewrite the client IP information,
142+
// and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
143+
// This field is required if mode is set.
144+
// +kubebuilder:validation:MaxItems=16
145+
// +listType=atomic
146+
//
147+
//
148+
// +optional
149+
TrustedAddresses []TrustedAddress `json:"trustedAddresses,omitempty"`
150+
}
151+
152+
// RewriteClientIPModeType defines how NGINX Gateway Fabric will determine the client's original IP address.
153+
// +kubebuilder:validation:Enum=ProxyProtocol;XForwardedFor
154+
type RewriteClientIPModeType string
155+
156+
const (
157+
// RewriteClientIPModeProxyProtocol configures NGINX to accept PROXY protocol and,
158+
// set the client's IP address to the IP address in the PROXY protocol header.
159+
// Sets the proxy_protocol parameter to the listen directive on all servers, and sets real_ip_header
160+
// to proxy_protocol: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header.
161+
RewriteClientIPModeProxyProtocol RewriteClientIPModeType = "ProxyProtocol"
162+
163+
// RewriteClientIPModeXForwardedFor configures NGINX to set the client's IP address to the
164+
// IP address in the X-Forwarded-For HTTP header.
165+
// https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header.
166+
RewriteClientIPModeXForwardedFor RewriteClientIPModeType = "XForwardedFor"
167+
)
168+
169+
// TrustedAddress is a string value representing a CIDR block.
170+
// Examples: 0.0.0.0/0
171+
//
172+
// +kubebuilder:validation:Pattern=`^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$`
173+
//
174+
//nolint:lll
175+
type TrustedAddress string

‎apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 35 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,10 @@ nginx:
9393
{}
9494
# disableHTTP2: false
9595
# ipFamily: dual
96+
# rewriteClientIP:
97+
# mode: "ProxyProtocol"
98+
# trustedAddresses: ["0.0.0.0/0"]
99+
# setIPRecursively: true
96100
# telemetry:
97101
# exporter:
98102
# endpoint: otel-collector.default.svc:4317

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,44 @@ spec:
6262
- ipv4
6363
- ipv6
6464
type: string
65+
rewriteClientIP:
66+
description: RewriteClientIP defines configuration for rewriting the
67+
client IP to the original client's IP.
68+
properties:
69+
mode:
70+
description: |-
71+
Mode defines how NGINX will rewrite the client's IP address.
72+
Possible modes: ProxyProtocol, XForwardedFor.
73+
enum:
74+
- ProxyProtocol
75+
- XForwardedFor
76+
type: string
77+
setIPRecursively:
78+
description: |-
79+
SetIPRecursively configures whether recursive search is used for selecting client's
80+
address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
81+
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
82+
array to start of array and select the first untrusted IP.
83+
type: boolean
84+
trustedAddresses:
85+
description: |-
86+
TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
87+
If a request comes from a trusted address, NGINX will rewrite the client IP information,
88+
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
89+
This field is required if mode is set.
90+
items:
91+
description: |-
92+
TrustedAddress is a string value representing a CIDR block.
93+
Examples: 0.0.0.0/0
94+
pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
95+
type: string
96+
maxItems: 16
97+
type: array
98+
x-kubernetes-list-type: atomic
99+
type: object
100+
x-kubernetes-validations:
101+
- message: if mode is set, trustedAddresses is a required field
102+
rule: '!(has(self.mode) && !has(self.trustedAddresses))'
65103
telemetry:
66104
description: Telemetry specifies the OpenTelemetry configuration.
67105
properties:

‎deploy/azure/deploy.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -321,6 +321,10 @@ metadata:
321321
name: nginx
322322
spec:
323323
controllerName: gateway.nginx.org/nginx-gateway-controller
324+
parametersRef:
325+
group: gateway.nginx.org
326+
kind: NginxProxy
327+
name: nginx-gateway-proxy-config
324328
---
325329
apiVersion: gateway.nginx.org/v1alpha1
326330
kind: NginxGateway
@@ -334,3 +338,19 @@ metadata:
334338
spec:
335339
logging:
336340
level: info
341+
---
342+
# Source: nginx-gateway-fabric/templates/nginxproxy.yaml
343+
apiVersion: gateway.nginx.org/v1alpha1
344+
kind: NginxProxy
345+
metadata:
346+
name: nginx-gateway-proxy-config
347+
labels:
348+
app.kubernetes.io/name: nginx-gateway
349+
app.kubernetes.io/instance: nginx-gateway
350+
app.kubernetes.io/version: "edge"
351+
spec:
352+
rewriteClientIP:
353+
mode: ProxyProtocol
354+
setIPRecursively: true
355+
trustedAddresses:
356+
- 0.0.0.0/0

‎deploy/crds.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -707,6 +707,44 @@ spec:
707707
- ipv4
708708
- ipv6
709709
type: string
710+
rewriteClientIP:
711+
description: RewriteClientIP defines configuration for rewriting the
712+
client IP to the original client's IP.
713+
properties:
714+
mode:
715+
description: |-
716+
Mode defines how NGINX will rewrite the client's IP address.
717+
Possible modes: ProxyProtocol, XForwardedFor.
718+
enum:
719+
- ProxyProtocol
720+
- XForwardedFor
721+
type: string
722+
setIPRecursively:
723+
description: |-
724+
SetIPRecursively configures whether recursive search is used for selecting client's
725+
address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
726+
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
727+
array to start of array and select the first untrusted IP.
728+
type: boolean
729+
trustedAddresses:
730+
description: |-
731+
TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
732+
If a request comes from a trusted address, NGINX will rewrite the client IP information,
733+
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
734+
This field is required if mode is set.
735+
items:
736+
description: |-
737+
TrustedAddress is a string value representing a CIDR block.
738+
Examples: 0.0.0.0/0
739+
pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
740+
type: string
741+
maxItems: 16
742+
type: array
743+
x-kubernetes-list-type: atomic
744+
type: object
745+
x-kubernetes-validations:
746+
- message: if mode is set, trustedAddresses is a required field
747+
rule: '!(has(self.mode) && !has(self.trustedAddresses))'
710748
telemetry:
711749
description: Telemetry specifies the OpenTelemetry configuration.
712750
properties:

‎deploy/default/deploy.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,6 +319,10 @@ metadata:
319319
name: nginx
320320
spec:
321321
controllerName: gateway.nginx.org/nginx-gateway-controller
322+
parametersRef:
323+
group: gateway.nginx.org
324+
kind: NginxProxy
325+
name: nginx-gateway-proxy-config
322326
---
323327
apiVersion: gateway.nginx.org/v1alpha1
324328
kind: NginxGateway
@@ -332,3 +336,19 @@ metadata:
332336
spec:
333337
logging:
334338
level: info
339+
---
340+
# Source: nginx-gateway-fabric/templates/nginxproxy.yaml
341+
apiVersion: gateway.nginx.org/v1alpha1
342+
kind: NginxProxy
343+
metadata:
344+
name: nginx-gateway-proxy-config
345+
labels:
346+
app.kubernetes.io/name: nginx-gateway
347+
app.kubernetes.io/instance: nginx-gateway
348+
app.kubernetes.io/version: "edge"
349+
spec:
350+
rewriteClientIP:
351+
mode: ProxyProtocol
352+
setIPRecursively: true
353+
trustedAddresses:
354+
- 0.0.0.0/0

‎deploy/experimental/deploy.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,10 @@ metadata:
325325
name: nginx
326326
spec:
327327
controllerName: gateway.nginx.org/nginx-gateway-controller
328+
parametersRef:
329+
group: gateway.nginx.org
330+
kind: NginxProxy
331+
name: nginx-gateway-proxy-config
328332
---
329333
apiVersion: gateway.nginx.org/v1alpha1
330334
kind: NginxGateway
@@ -338,3 +342,19 @@ metadata:
338342
spec:
339343
logging:
340344
level: info
345+
---
346+
# Source: nginx-gateway-fabric/templates/nginxproxy.yaml
347+
apiVersion: gateway.nginx.org/v1alpha1
348+
kind: NginxProxy
349+
metadata:
350+
name: nginx-gateway-proxy-config
351+
labels:
352+
app.kubernetes.io/name: nginx-gateway
353+
app.kubernetes.io/instance: nginx-gateway
354+
app.kubernetes.io/version: "edge"
355+
spec:
356+
rewriteClientIP:
357+
mode: ProxyProtocol
358+
setIPRecursively: true
359+
trustedAddresses:
360+
- 0.0.0.0/0

‎deploy/nodeport/deploy.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,6 +319,10 @@ metadata:
319319
name: nginx
320320
spec:
321321
controllerName: gateway.nginx.org/nginx-gateway-controller
322+
parametersRef:
323+
group: gateway.nginx.org
324+
kind: NginxProxy
325+
name: nginx-gateway-proxy-config
322326
---
323327
apiVersion: gateway.nginx.org/v1alpha1
324328
kind: NginxGateway
@@ -332,3 +336,19 @@ metadata:
332336
spec:
333337
logging:
334338
level: info
339+
---
340+
# Source: nginx-gateway-fabric/templates/nginxproxy.yaml
341+
apiVersion: gateway.nginx.org/v1alpha1
342+
kind: NginxProxy
343+
metadata:
344+
name: nginx-gateway-proxy-config
345+
labels:
346+
app.kubernetes.io/name: nginx-gateway
347+
app.kubernetes.io/instance: nginx-gateway
348+
app.kubernetes.io/version: "edge"
349+
spec:
350+
rewriteClientIP:
351+
mode: ProxyProtocol
352+
setIPRecursively: true
353+
trustedAddresses:
354+
- 0.0.0.0/0

‎internal/mode/static/nginx/config/http/config.go

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,13 +109,22 @@ type ProxySSLVerify struct {
109109

110110
// ServerConfig holds configuration for an HTTP server and IP family to be used by NGINX.
111111
type ServerConfig struct {
112-
Servers []Server
113-
IPFamily shared.IPFamily
114-
Plus bool
112+
Servers []Server
113+
RewriteClientIP RewriteClientIPSettings
114+
IPFamily shared.IPFamily
115+
Plus bool
115116
}
116117

117118
// Include defines a file that's included via the include directive.
118119
type Include struct {
119120
Name string
120121
Content []byte
121122
}
123+
124+
// RewriteClientIP holds the configuration for the rewrite client IP settings.
125+
type RewriteClientIPSettings struct {
126+
RealIPHeader string
127+
RealIPFrom []string
128+
Recursive bool
129+
ProxyProtocol bool
130+
}

0 commit comments

Comments
 (0)