ingress-nginx
ingress-nginx copied to clipboard
kubernetes
Allow overriding real_ip_recursive
What this PR does / why we need it:
Allows control over real_ip_recursive, fixing problem shown in issues like: https://github.com/kubernetes/ingress-nginx/issues/4073
We are using this to fix a X-Forwarded-For spoofing issue we found while using AWS ALB as a service load balancer. Turns out they respect upstream X-Forwarded-For and don't allow us to strip/replace them, causing NGINX Ingress Controller to take the first value of the header as the defacto client IP, which can be spoofed.
Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] Documentation only
Which issue/s this PR fixes
https://github.com/kubernetes/ingress-nginx/issues/4073
How Has This Been Tested?
Checklist:
- [ ] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] I've read the CONTRIBUTION guide
- [x] I have added tests to cover my changes.
- [x] All new and existing tests passed.
The committers listed above are authorized under a signed CLA.
- :white_check_mark: login: tomaspinho / name: Tomás Pinho (bcab7c1f0bf3dd5032860bb9ecdd93b0b9c4c822, fbb2c3bfe74258706aa5b88194b54971ed22f526, 8a268e46e23c3a5052bc0a76c695a31aff5d3023, ae7fee940fa31c438d2d2c4b6e032ebcaebd7646, 93f0afc60f1b2cbaf400d2198e3bc9794e68405b, 6d613e725bd247da9774ca52fcd6cc0abd3e6445, 5b21caf09bf22cb8bb41ac6d92eb68fa7a534f75)
![linux-foundation-easycla[bot] avatar](https://avatars.githubusercontent.com/in/17893?v=4 "Published by a pub.dev verified publisher"){kind=small}
Welcome @tomaspinho!
It looks like this is your first PR to kubernetes/ingress-nginx 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.
You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.
You can also check if kubernetes/ingress-nginx has its own contribution guidelines.
You may want to refer to our testing guide if you run into trouble with your tests not passing.
If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!
Thank you, and welcome to Kubernetes. :smiley:
Hi @tomaspinho. Thanks for your PR.
I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.
Once the patch is verified, the new status will be reflected by the ok-to-test label.
I understand the commands that are listed here.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
@tomaspinho thanks for contributing to this long pending issue. Helps a lot.
Any chance that a e2e test can be added that simulates the complete event sequence from a client spoofing the ip with X-Forward-For header and the controller picking one the last "real" client_ip_address.
It's my first time contributing to this project, so I have to learn how to run and write e2e tests.
I hope to have some time this weekend to take a look at this. Thanks @longwuyuan
@longwuyuan turns out writing the e2e test was way easier than I expected! You folks have done an amazing job here :star_struck:
Added an e2e test exercising both cases for the flag.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue or PR as fresh with
/remove-lifecycle stale - Mark this issue or PR as rotten with
/lifecycle rotten - Close this issue or PR with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue or PR as fresh with
/remove-lifecycle stale - Mark this issue or PR as rotten with
/lifecycle rotten - Close this issue or PR with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue or PR as fresh with
/remove-lifecycle rotten - Close this issue or PR with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the PR is closed
You can:
- Reopen this PR with
/reopen - Mark this PR as fresh with
/remove-lifecycle rotten - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/close
@k8s-triage-robot: Closed this PR.
In response to this:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied- After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied- After 30d of inactivity since
lifecycle/rottenwas applied, the PR is closedYou can:
- Reopen this PR with
/reopen- Mark this PR as fresh with
/remove-lifecycle rotten- Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
@longwuyuan looks like this one was never merged, but it fixes a real issue. Would it be possible to consider reopening and performing a final review?
@longwuyuan @rikatz @strongjz sorry to tag but any chance this PR got missed during the change freeze? It does indeed fix a real issue and would be really cool to have this option.
We're keeping a custom version of NGINX Ingress Controller's nginx.conf in order to work around this issue, but it still very much affects us and I would love to see this merged :D
looks like this PR was abandoned but it addresses a vital issue. Are there any chances to merge?
Deploy Preview for kubernetes-ingress-nginx ready!
| Name | Link |
|---|---|
| Latest commit | 6d613e725bd247da9774ca52fcd6cc0abd3e6445 |
| Latest deploy log | https://app.netlify.com/sites/kubernetes-ingress-nginx/deploys/65df1e5cb3e7e400087b2b2a |
| Deploy Preview | https://deploy-preview-8366--kubernetes-ingress-nginx.netlify.app |
| Preview on mobile | Toggle QR Code...Use your smartphone camera to open QR code link. |
To edit notification comments on pull requests, go to your Netlify site configuration.
![netlify[bot] avatar](https://avatars.githubusercontent.com/in/13473?v=4 "Published by a pub.dev verified publisher"){kind=small}
[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: tomaspinho Once this PR has been reviewed and has the lgtm label, please ask for approval from strongjz. For more information see the Kubernetes Code Review Process.
The full list of commands accepted by this bot can be found here.
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
Hey @rikatz @strongjz! :smile:
Just rebased this PR and fixed the linting/formatting according to upstream. Wondering if there's anything you need from me in order to merge? Thanks!
