[stable/traefik] Add proxyProtocol support (#3215)

* Add support for proxyProtocol.

* Modify version, increase minor due to feature add.

* Add a description regarding ProxyProtocol.

* Explain the new options.

* Documentation changes, as suggested.

* Add support for proxyProtocol.

* Add a description regarding ProxyProtocol.

* Explain the new options.

* Documentation changes, as suggested.

* Hopefully improve the explanation.

* Move some duplicated code to _helpers.

* Add starting space to appease CI.

* Fix README, fix Chart.

* Remove unnecessary comment.

* Explain how to set ELB to Proxy

stable/traefik/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: traefik
-version: 1.17.1
+version: 1.18.0
 appVersion: 1.4.6
 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support
 keywords:

stable/traefik/README.md

@@ -98,6 +98,8 @@ The following tables lists the configurable parameters of the Traefik chart and
 | `rbac.enabled`                  | Whether to enable RBAC with a specific cluster role and binding for Traefik | `false`                            |
 | `nodeSelector`                  | Node labels for pod assignment                                       | `{}`                                      |
 | `tolerations`                   | List of node taints to tolerate                                      | `[]`                                      |
+| `proxyProtocol.enabled`         | Enable PROXY protocol support.                                       | `false`                                   |
+| `proxyProtocol.trustedIPs`      | List of proxy IPs (CIDR ranges) trusted to accurately convey the end-user IP. | `[]`                              |
 | `debug.enabled`                 | Turn on/off Traefik's debug mode. Enabling it will override the logLevel to `DEBUG` and provide `/debug/vars` endpoint that allows Go runtime stats to be inspected, such as number of Goroutines and memory stats | `false`                                   |
 | `ssl.enabled`                   | Whether to enable HTTPS                                              | `false`                                   |
 | `ssl.enforced`                  | Whether to redirect HTTP requests to HTTPS                           | `false`                                   |
@@ -185,3 +187,13 @@ dashboard:
     basic:
       test: $apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
 ```
+
+### Proxy Protocol
+
+In situations where Traefik lives behind an Internet-facing loadbalancer (like an AWS ELB) and you still want it to see the actual source IP of the visitor instead of the internal IP of the loadbalancer, you can enable the loadbalancer to use the Proxy protocol to talk to Traefik. This effectively makes the loadbalancer transparant, as Traefik will still get the actual visitor IP address for each request. This only works if Traefik knows it's receiving traffic via the Proxy Protocol and the loadbalancer IP addresses need to be whitelisted as well.
+
+How to set this up on AWS is described in the Kubernetes documentation [here](https://kubernetes.io/docs/concepts/services-networking/service/#proxy-protocol-support-on-aws), it can easily be done by adding an annotation to the Service definition.
+
+**Caution**
+
+If only one of the components (either the loadbalancer or traefik) is set to use the Proxy protocol and the other is not, this will break badly as they will not be able to communicate with each other.

stable/traefik/templates/_helpers.tpl

@@ -7,3 +7,15 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- define "fullname" -}}
 {{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+
+{{/*
+Create the block for the ProxyProtocol's Trusted IPs.
+*/}}
+{{- define "trustedips" -}}
+         trustedIPs = [
+	   {{- range $idx, $ips := .Values.proxyProtocol.trustedIPs }}
+	     {{- if $idx }}, {{ end }}
+	     {{- $ips | quote }}
+	   {{- end -}}
+         ]
+{{- end -}}

stable/traefik/templates/configmap.yaml

@@ -22,6 +22,10 @@ data:
     [entryPoints]
       [entryPoints.http]
       address = ":80"
+      {{- if .Values.proxyProtocol.enabled }}
+        [entryPoints.http.proxyProtocol]
+        {{ template "trustedips" . }}
+      {{- end }}
       compress = {{ .Values.gzip.enabled }}
         {{- if .Values.ssl.enforced }}
         [entryPoints.http.redirect]
@@ -31,6 +35,10 @@ data:
       {{- if .Values.ssl.enabled }}
       [entryPoints.https]
       address = ":443"
+      {{- if .Values.proxyProtocol.enabled }}
+        [entryPoints.https.proxyProtocol]
+        {{ template "proxyprotocol" . }}
+      {{- end }}
       compress = {{ .Values.gzip.enabled }}
         [entryPoints.https.tls]
           [[entryPoints.https.tls.certificates]]

stable/traefik/values.yaml

@@ -24,6 +24,11 @@ tolerations: []
   # namespaces:
   # - default
   # labelSelector:
+proxyProtocol:
+  enabled: false
+  # trustedIPs is required when enabled
+  trustedIPs:
+  # - 10.0.0.0/8
 ssl:
   enabled: false
   enforced: false