[stable/traefik] Add support to configure forwarded headers from trusted clients (#8239)

Signed-off-by: Samuel Barabas <samuel@owee.de>

stable/traefik/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: traefik
-version: 1.47.1
+version: 1.48.0
 appVersion: 1.7.2
 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support
 keywords:

stable/traefik/README.md

@@ -108,6 +108,8 @@ The following table lists the configurable parameters of the Traefik chart and t
 | `tolerations`                          | List of node taints to tolerate                                                                                              | `[]`                                              |
 | `proxyProtocol.enabled`                | Enable PROXY protocol support.                                                                                               | `false`                                           |
 | `proxyProtocol.trustedIPs`             | List of PROXY IPs (CIDR ranges) trusted to accurately convey the end-user IP.                                                | `[]`                                              |
+| `forwardedHeaders.enabled`             | Enable support specify trusted clients for forwarded headers.                                                                | `false`                                           |
+| `forwardedHeaders.trustedIPs`          | List of IPs (CIDR ranges) to be authorized to trust the client forwarded headers (X-Forwarded-*).                            | `[]`                                              |
 | `debug.enabled`                        | Turn on/off Traefik's debug mode. Enabling it will override the logLevel to `DEBUG` and provide `/debug/vars` endpoint that allows Go runtime stats to be inspected, such as number of Goroutines and memory stats | `false`                                   |
 | `ssl.enabled`                          | Whether to enable HTTPS                                                                                                      | `false`                                           |
 | `ssl.enforced`                         | Whether to redirect HTTP requests to HTTPS                                                                                   | `false`                                           |

stable/traefik/templates/_helpers.tpl

@@ -38,6 +38,18 @@ Create the block for the ProxyProtocol's Trusted IPs.
          ]
 {{- end -}}
 
+{{/*
+Create the block for the forwardedHeaders's Trusted IPs.
+*/}}
+{{- define "traefik.forwardedHeadersTrustedIPs" -}}
+         trustedIPs = [
+	   {{- range $idx, $ips := .Values.forwardedHeaders.trustedIPs }}
+	     {{- if $idx }}, {{ end }}
+	     {{- $ips | quote }}
+	   {{- end -}}
+         ]
+{{- end -}}
+
 {{/*
 Create the block for whiteListSourceRange.
 */}}

stable/traefik/templates/configmap.yaml

@@ -39,6 +39,10 @@ data:
       {{- if .Values.proxyProtocol.enabled }}
         [entryPoints.http.proxyProtocol]
         {{ template "traefik.trustedips" . }}
+      {{- end }}
+      {{- if .Values.forwardedHeaders.enabled }}
+        [entryPoints.http.forwardedHeaders]
+        {{ template "traefik.forwardedHeadersTrustedIPs" . }}
       {{- end }}
         {{- if .Values.ssl.enforced }}
         [entryPoints.http.redirect]
@@ -56,6 +60,10 @@ data:
         [entryPoints.https.proxyProtocol]
         {{ template "traefik.trustedips" . }}
       {{- end }}
+      {{- if .Values.forwardedHeaders.enabled }}
+        [entryPoints.https.forwardedHeaders]
+        {{ template "traefik.forwardedHeadersTrustedIPs" . }}
+      {{- end }}
       {{- if not .Values.ssl.upstream }}
         [entryPoints.https.tls]
           {{- if .Values.ssl.tlsMinVersion }}

stable/traefik/values.yaml

@@ -53,6 +53,11 @@ proxyProtocol:
   # trustedIPs is required when enabled
   trustedIPs: []
   # - 10.0.0.0/8
+forwardedHeaders:
+  enabled: false
+  # trustedIPs is required when enabled
+  trustedIPs: []
+  # - 10.0.0.0/8
 ssl:
   enabled: false
   enforced: false