Allow setting of trusted CIDR blocks for X-Forwarded-For

[robd003]

Description: Last week Envoy just released support for trusted CIDR blocks when processing X-Forwarded-For headers.

It would be really useful to have a default configuration mode called "cloudflare" which would automatically load the IP ranges from these two dynamically updated lists:

Cloudflare IPv4 CIDR blocks: https://www.cloudflare.com/ips-v4/ Cloudflare IPv6 CIDR blocks: https://www.cloudflare.com/ips-v6/

[optional Relevant Links:] https://github.com/envoyproxy/envoy/pull/31831 https://github.com/envoyproxy/envoy/releases/tag/v1.32.0

[zhaohuabing]

A knob for configuring CIDR can be added to the ClientTrafficPolicySpec.ClientIPDetection.XForwardedForSettings,

NumTrustedHops: 2
TrustedCIDRs:
  - 173.245.48.0/20
  - 103.21.244.0/22

Given that the IP lists are updated only once a year, I believe it’s reasonable to just manually update the CTP whenever Cloudflare makes changes. cc @envoyproxy/gateway-maintainers

[arkodg]

+1 to a generic trustedCIDRs

[rudrakhp]

@arkodg I would like to contribute to this, please assign if help wanted. Thanks!

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[robd003]

Can we keep this open until the code is actually released (1.3.0?) with documentation?

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[rudrakhp]

@arkodg do we have anything pending in this issue?

[arkodg]

@rudrakhp are we tracking the regression associated with losing out on X-Envoy-Internal-Address anywhere ?