Skip to content

Commit e7f3cca

Browse files
salonichf5salonichf5
committed
add support for preserving clientIP
1 parent 0d42a7b commit e7f3cca

File tree

26 files changed

+792
-64
lines changed

26 files changed

+792
-64
lines changed

‎apis/v1alpha1/nginxproxy_types.go

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ type NginxProxySpec struct {
5353
//
5454
// +optional
5555
Telemetry *Telemetry `json:"telemetry,omitempty"`
56+
// RewriteClientIP defines configuration for rewriting the client IP to the original client's IP.
57+
// +kubebuilder:validation:XValidation:message="if mode is set, trustedAddresses is a required field",rule="!(has(self.mode) && !has(self.trustedAddresses))"
58+
//
59+
// +optional
60+
//nolint:lll
61+
RewriteClientIP *RewriteClientIP `json:"rewriteClientIP,omitempty"`
5662
// DisableHTTP2 defines if http2 should be disabled for all servers.
5763
// Default is false, meaning http2 will be enabled for all servers.
5864
//
@@ -114,3 +120,56 @@ type TelemetryExporter struct {
114120
// +kubebuilder:validation:Pattern=`^(?:http?:\/\/)?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*(?::\d{1,5})?$`
115121
Endpoint string `json:"endpoint"`
116122
}
123+
124+
// RewriteClientIP specifies the configuration for rewriting the client's IP address.
125+
type RewriteClientIP struct {
126+
// Mode defines how NGINX will rewrite the client's IP address.
127+
// Possible modes: ProxyProtocol, XForwardedFor.
128+
//
129+
// +optional
130+
Mode *RewriteClientIPModeType `json:"mode,omitempty"`
131+
132+
// SetIPRecursively configures whether recursive search is used for selecting client's
133+
// address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
134+
// If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
135+
// array to start of array and select the first untrusted IP.
136+
//
137+
// +optional
138+
SetIPRecursively *bool `json:"setIPRecursively,omitempty"`
139+
140+
// TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
141+
// If a request comes from a trusted address, NGINX will rewrite the client IP information,
142+
// and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
143+
// This field is required if mode is set.
144+
// +kubebuilder:validation:MaxItems=16
145+
// +listType=atomic
146+
//
147+
//
148+
// +optional
149+
TrustedAddresses []TrustedAddress `json:"trustedAddresses,omitempty"`
150+
}
151+
152+
// RewriteClientIPModeType defines how NGINX Gateway Fabric will determine the client's original IP address.
153+
// +kubebuilder:validation:Enum=ProxyProtocol;XForwardedFor
154+
type RewriteClientIPModeType string
155+
156+
const (
157+
// RewriteClientIPModeProxyProtocol configures NGINX to accept PROXY protocol and,
158+
// set the client's IP address to the IP address in the PROXY protocol header.
159+
// Sets the proxy_protocol parameter to the listen directive on all servers, and sets real_ip_header
160+
// to proxy_protocol: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header.
161+
RewriteClientIPModeProxyProtocol RewriteClientIPModeType = "ProxyProtocol"
162+
163+
// RewriteClientIPModeXForwardedFor configures NGINX to set the client's IP address to the
164+
// IP address in the X-Forwarded-For HTTP header.
165+
// https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header.
166+
RewriteClientIPModeXForwardedFor RewriteClientIPModeType = "XForwardedFor"
167+
)
168+
169+
// TrustedAddress is a string value representing a CIDR block.
170+
// Examples: 0.0.0.0/0
171+
//
172+
// +kubebuilder:validation:Pattern=`^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$`
173+
//
174+
//nolint:lll
175+
type TrustedAddress string

‎apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 35 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/nginx-gateway-fabric/README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -263,8 +263,8 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
263263
| `nginx.config` | The configuration for the data plane that is contained in the NginxProxy resource. | object | `{}` |
264264
| `nginx.extraVolumeMounts` | extraVolumeMounts are the additional volume mounts for the nginx container. | list | `[]` |
265265
| `nginx.image.pullPolicy` | | string | `"Always"` |
266-
| `nginx.image.repository` | The NGINX image to use. | string | `"ghcr.io/nginxinc/nginx-gateway-fabric/nginx"` |
267-
| `nginx.image.tag` | | string | `"edge"` |
266+
| `nginx.image.repository` | The NGINX image to use. | string | `"gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric/nginx"` |
267+
| `nginx.image.tag` | | string | `"sa.choudhary"` |
268268
| `nginx.lifecycle` | The lifecycle of the nginx container. | object | `{}` |
269269
| `nginx.plus` | Is NGINX Plus image being used | bool | `false` |
270270
| `nginx.usage.clusterName` | The display name of the Kubernetes cluster in the NGINX Plus usage reporting server. | string | `""` |
@@ -279,8 +279,8 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
279279
| `nginxGateway.gatewayControllerName` | The name of the Gateway controller. The controller name must be of the form: DOMAIN/PATH. The controller's domain is gateway.nginx.org. | string | `"gateway.nginx.org/nginx-gateway-controller"` |
280280
| `nginxGateway.gwAPIExperimentalFeatures.enable` | Enable the experimental features of Gateway API which are supported by NGINX Gateway Fabric. Requires the Gateway APIs installed from the experimental channel. | bool | `false` |
281281
| `nginxGateway.image.pullPolicy` | | string | `"Always"` |
282-
| `nginxGateway.image.repository` | The NGINX Gateway Fabric image to use | string | `"ghcr.io/nginxinc/nginx-gateway-fabric"` |
283-
| `nginxGateway.image.tag` | | string | `"edge"` |
282+
| `nginxGateway.image.repository` | The NGINX Gateway Fabric image to use | string | `"gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric"` |
283+
| `nginxGateway.image.tag` | | string | `"sa.choudhary"` |
284284
| `nginxGateway.kind` | The kind of the NGINX Gateway Fabric installation - currently, only deployment is supported. | string | `"deployment"` |
285285
| `nginxGateway.leaderElection.enable` | Enable leader election. Leader election is used to avoid multiple replicas of the NGINX Gateway Fabric reporting the status of the Gateway API resources. If not enabled, all replicas of NGINX Gateway Fabric will update the statuses of the Gateway API resources. | bool | `true` |
286286
| `nginxGateway.leaderElection.lockName` | The name of the leader election lock. A Lease object with this name will be created in the same Namespace as the controller. | string | Autogenerated if not set or set to "". |

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ nginxGateway:
5252

5353
image:
5454
# -- The NGINX Gateway Fabric image to use
55-
repository: ghcr.io/nginxinc/nginx-gateway-fabric
56-
tag: edge
55+
repository: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric
56+
tag: sa.choudhary
5757
pullPolicy: Always
5858

5959
securityContext:
@@ -81,8 +81,8 @@ nginxGateway:
8181
nginx:
8282
image:
8383
# -- The NGINX image to use.
84-
repository: ghcr.io/nginxinc/nginx-gateway-fabric/nginx
85-
tag: edge
84+
repository: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric/nginx
85+
tag: sa.choudhary
8686
pullPolicy: Always
8787

8888
# -- Is NGINX Plus image being used
@@ -93,6 +93,10 @@ nginx:
9393
{}
9494
# disableHTTP2: false
9595
# ipFamily: dual
96+
# rewriteClientIP:
97+
# mode: "ProxyProtocol"
98+
# trustedAddresses: ["0.0.0.0/0"]
99+
# setIPRecursively: true
96100
# telemetry:
97101
# exporter:
98102
# endpoint: otel-collector.default.svc:4317

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,44 @@ spec:
6262
- ipv4
6363
- ipv6
6464
type: string
65+
rewriteClientIP:
66+
description: RewriteClientIP defines configuration for rewriting the
67+
client IP to the original client's IP.
68+
properties:
69+
mode:
70+
description: |-
71+
Mode defines how NGINX will rewrite the client's IP address.
72+
Possible modes: ProxyProtocol, XForwardedFor.
73+
enum:
74+
- ProxyProtocol
75+
- XForwardedFor
76+
type: string
77+
setIPRecursively:
78+
description: |-
79+
SetIPRecursively configures whether recursive search is used for selecting client's
80+
address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
81+
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
82+
array to start of array and select the first untrusted IP.
83+
type: boolean
84+
trustedAddresses:
85+
description: |-
86+
TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
87+
If a request comes from a trusted address, NGINX will rewrite the client IP information,
88+
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
89+
This field is required if mode is set.
90+
items:
91+
description: |-
92+
TrustedAddress is a string value representing a CIDR block.
93+
Examples: 0.0.0.0/0
94+
pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
95+
type: string
96+
maxItems: 16
97+
type: array
98+
x-kubernetes-list-type: atomic
99+
type: object
100+
x-kubernetes-validations:
101+
- message: if mode is set, trustedAddresses is a required field
102+
rule: '!(has(self.mode) && !has(self.trustedAddresses))'
65103
telemetry:
66104
description: Telemetry specifies the OpenTelemetry configuration.
67105
properties:

‎config/tests/static-deployment.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ spec:
4545
valueFrom:
4646
fieldRef:
4747
fieldPath: metadata.name
48-
image: ghcr.io/nginxinc/nginx-gateway-fabric:edge
48+
image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric:sa.choudhary
4949
imagePullPolicy: Always
5050
name: nginx-gateway
5151
ports:
@@ -82,7 +82,7 @@ spec:
8282
mountPath: /var/run/nginx
8383
- name: nginx-includes
8484
mountPath: /etc/nginx/includes
85-
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
85+
- image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric/nginx:sa.choudhary
8686
imagePullPolicy: Always
8787
name: nginx
8888
ports:

‎deploy/aws-nlb/deploy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,7 @@ spec:
217217
valueFrom:
218218
fieldRef:
219219
fieldPath: metadata.name
220-
image: ghcr.io/nginxinc/nginx-gateway-fabric:edge
220+
image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric:sa.choudhary
221221
imagePullPolicy: Always
222222
name: nginx-gateway
223223
ports:
@@ -256,7 +256,7 @@ spec:
256256
name: nginx-run
257257
- mountPath: /etc/nginx/includes
258258
name: nginx-includes
259-
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
259+
- image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric/nginx:sa.choudhary
260260
imagePullPolicy: Always
261261
name: nginx
262262
ports:

‎deploy/azure/deploy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ spec:
214214
valueFrom:
215215
fieldRef:
216216
fieldPath: metadata.name
217-
image: ghcr.io/nginxinc/nginx-gateway-fabric:edge
217+
image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric:sa.choudhary
218218
imagePullPolicy: Always
219219
name: nginx-gateway
220220
ports:
@@ -253,7 +253,7 @@ spec:
253253
name: nginx-run
254254
- mountPath: /etc/nginx/includes
255255
name: nginx-includes
256-
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
256+
- image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric/nginx:sa.choudhary
257257
imagePullPolicy: Always
258258
name: nginx
259259
ports:

‎deploy/crds.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -647,6 +647,44 @@ spec:
647647
- ipv4
648648
- ipv6
649649
type: string
650+
rewriteClientIP:
651+
description: RewriteClientIP defines configuration for rewriting the
652+
client IP to the original client's IP.
653+
properties:
654+
mode:
655+
description: |-
656+
Mode defines how NGINX will rewrite the client's IP address.
657+
Possible modes: ProxyProtocol, XForwardedFor.
658+
enum:
659+
- ProxyProtocol
660+
- XForwardedFor
661+
type: string
662+
setIPRecursively:
663+
description: |-
664+
SetIPRecursively configures whether recursive search is used for selecting client's
665+
address from the X-Forwarded-For header and used in conjunction with TrustedAddresses.
666+
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of
667+
array to start of array and select the first untrusted IP.
668+
type: boolean
669+
trustedAddresses:
670+
description: |-
671+
TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
672+
If a request comes from a trusted address, NGINX will rewrite the client IP information,
673+
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
674+
This field is required if mode is set.
675+
items:
676+
description: |-
677+
TrustedAddress is a string value representing a CIDR block.
678+
Examples: 0.0.0.0/0
679+
pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
680+
type: string
681+
maxItems: 16
682+
type: array
683+
x-kubernetes-list-type: atomic
684+
type: object
685+
x-kubernetes-validations:
686+
- message: if mode is set, trustedAddresses is a required field
687+
rule: '!(has(self.mode) && !has(self.trustedAddresses))'
650688
telemetry:
651689
description: Telemetry specifies the OpenTelemetry configuration.
652690
properties:

‎deploy/default/deploy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ spec:
214214
valueFrom:
215215
fieldRef:
216216
fieldPath: metadata.name
217-
image: ghcr.io/nginxinc/nginx-gateway-fabric:edge
217+
image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric:sa.choudhary
218218
imagePullPolicy: Always
219219
name: nginx-gateway
220220
ports:
@@ -253,7 +253,7 @@ spec:
253253
name: nginx-run
254254
- mountPath: /etc/nginx/includes
255255
name: nginx-includes
256-
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
256+
- image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric/nginx:sa.choudhary
257257
imagePullPolicy: Always
258258
name: nginx
259259
ports:

‎deploy/experimental-nginx-plus/deploy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ spec:
229229
valueFrom:
230230
fieldRef:
231231
fieldPath: metadata.name
232-
image: ghcr.io/nginxinc/nginx-gateway-fabric:edge
232+
image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric:sa.choudhary
233233
imagePullPolicy: Always
234234
name: nginx-gateway
235235
ports:
@@ -268,7 +268,7 @@ spec:
268268
name: nginx-run
269269
- mountPath: /etc/nginx/includes
270270
name: nginx-includes
271-
- image: private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:edge
271+
- image: private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:sa.choudhary
272272
imagePullPolicy: Always
273273
name: nginx
274274
ports:

‎deploy/experimental/deploy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ spec:
220220
valueFrom:
221221
fieldRef:
222222
fieldPath: metadata.name
223-
image: ghcr.io/nginxinc/nginx-gateway-fabric:edge
223+
image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric:sa.choudhary
224224
imagePullPolicy: Always
225225
name: nginx-gateway
226226
ports:
@@ -259,7 +259,7 @@ spec:
259259
name: nginx-run
260260
- mountPath: /etc/nginx/includes
261261
name: nginx-includes
262-
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
262+
- image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric/nginx:sa.choudhary
263263
imagePullPolicy: Always
264264
name: nginx
265265
ports:

‎deploy/nginx-plus/deploy.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ spec:
225225
valueFrom:
226226
fieldRef:
227227
fieldPath: metadata.name
228-
image: ghcr.io/nginxinc/nginx-gateway-fabric:edge
228+
image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nginx-gateway-fabric:sa.choudhary
229229
imagePullPolicy: Always
230230
name: nginx-gateway
231231
ports:
@@ -264,7 +264,7 @@ spec:
264264
name: nginx-run
265265
- mountPath: /etc/nginx/includes
266266
name: nginx-includes
267-
- image: private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:edge
267+
- image: private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:sa.choudhary
268268
imagePullPolicy: Always
269269
name: nginx
270270
ports:

0 commit comments

Comments
 (0)