From 35ff7a90369238a82d62cd516d4eb6c49c28344c Mon Sep 17 00:00:00 2001 From: Samuel Barabas Date: Sun, 7 Oct 2018 21:23:42 +0200 Subject: [PATCH] [stable/traefik] Add support to configure forwarded headers from trusted clients (#8239) Signed-off-by: Samuel Barabas --- stable/traefik/Chart.yaml | 2 +- stable/traefik/README.md | 2 ++ stable/traefik/templates/_helpers.tpl | 12 ++++++++++++ stable/traefik/templates/configmap.yaml | 8 ++++++++ stable/traefik/values.yaml | 5 +++++ 5 files changed, 28 insertions(+), 1 deletion(-) diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml index 91b426a1c3..4f04638d24 100755 --- a/stable/traefik/Chart.yaml +++ b/stable/traefik/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: traefik -version: 1.47.1 +version: 1.48.0 appVersion: 1.7.2 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support keywords: diff --git a/stable/traefik/README.md b/stable/traefik/README.md index f87b7119ee..caeab5419f 100644 --- a/stable/traefik/README.md +++ b/stable/traefik/README.md @@ -108,6 +108,8 @@ The following table lists the configurable parameters of the Traefik chart and t | `tolerations` | List of node taints to tolerate | `[]` | | `proxyProtocol.enabled` | Enable PROXY protocol support. | `false` | | `proxyProtocol.trustedIPs` | List of PROXY IPs (CIDR ranges) trusted to accurately convey the end-user IP. | `[]` | +| `forwardedHeaders.enabled` | Enable support specify trusted clients for forwarded headers. | `false` | +| `forwardedHeaders.trustedIPs` | List of IPs (CIDR ranges) to be authorized to trust the client forwarded headers (X-Forwarded-*). | `[]` | | `debug.enabled` | Turn on/off Traefik's debug mode. Enabling it will override the logLevel to `DEBUG` and provide `/debug/vars` endpoint that allows Go runtime stats to be inspected, such as number of Goroutines and memory stats | `false` | | `ssl.enabled` | Whether to enable HTTPS | `false` | | `ssl.enforced` | Whether to redirect HTTP requests to HTTPS | `false` | diff --git a/stable/traefik/templates/_helpers.tpl b/stable/traefik/templates/_helpers.tpl index a3bfdda50d..a8491b3acb 100644 --- a/stable/traefik/templates/_helpers.tpl +++ b/stable/traefik/templates/_helpers.tpl @@ -38,6 +38,18 @@ Create the block for the ProxyProtocol's Trusted IPs. ] {{- end -}} +{{/* +Create the block for the forwardedHeaders's Trusted IPs. +*/}} +{{- define "traefik.forwardedHeadersTrustedIPs" -}} + trustedIPs = [ + {{- range $idx, $ips := .Values.forwardedHeaders.trustedIPs }} + {{- if $idx }}, {{ end }} + {{- $ips | quote }} + {{- end -}} + ] +{{- end -}} + {{/* Create the block for whiteListSourceRange. */}} diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml index c5284fe6ab..9b9d8be860 100644 --- a/stable/traefik/templates/configmap.yaml +++ b/stable/traefik/templates/configmap.yaml @@ -39,6 +39,10 @@ data: {{- if .Values.proxyProtocol.enabled }} [entryPoints.http.proxyProtocol] {{ template "traefik.trustedips" . }} + {{- end }} + {{- if .Values.forwardedHeaders.enabled }} + [entryPoints.http.forwardedHeaders] + {{ template "traefik.forwardedHeadersTrustedIPs" . }} {{- end }} {{- if .Values.ssl.enforced }} [entryPoints.http.redirect] @@ -56,6 +60,10 @@ data: [entryPoints.https.proxyProtocol] {{ template "traefik.trustedips" . }} {{- end }} + {{- if .Values.forwardedHeaders.enabled }} + [entryPoints.https.forwardedHeaders] + {{ template "traefik.forwardedHeadersTrustedIPs" . }} + {{- end }} {{- if not .Values.ssl.upstream }} [entryPoints.https.tls] {{- if .Values.ssl.tlsMinVersion }} diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml index adc3f4a3c2..d8656ebe78 100644 --- a/stable/traefik/values.yaml +++ b/stable/traefik/values.yaml @@ -53,6 +53,11 @@ proxyProtocol: # trustedIPs is required when enabled trustedIPs: [] # - 10.0.0.0/8 +forwardedHeaders: + enabled: false + # trustedIPs is required when enabled + trustedIPs: [] + # - 10.0.0.0/8 ssl: enabled: false enforced: false