From b8658d649431f1abb6be69ade27f47eebae9a1ee Mon Sep 17 00:00:00 2001 From: Tim Stoop Date: Fri, 9 Feb 2018 21:03:51 +0100 Subject: [PATCH] [stable/traefik] Add proxyProtocol support (#3215) * Add support for proxyProtocol. * Modify version, increase minor due to feature add. * Add a description regarding ProxyProtocol. * Explain the new options. * Documentation changes, as suggested. * Add support for proxyProtocol. * Add a description regarding ProxyProtocol. * Explain the new options. * Documentation changes, as suggested. * Hopefully improve the explanation. * Move some duplicated code to _helpers. * Add starting space to appease CI. * Fix README, fix Chart. * Remove unnecessary comment. * Explain how to set ELB to Proxy --- stable/traefik/Chart.yaml | 2 +- stable/traefik/README.md | 12 ++++++++++++ stable/traefik/templates/_helpers.tpl | 12 ++++++++++++ stable/traefik/templates/configmap.yaml | 8 ++++++++ stable/traefik/values.yaml | 5 +++++ 5 files changed, 38 insertions(+), 1 deletion(-) diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml index 323926cc17..732430e197 100755 --- a/stable/traefik/Chart.yaml +++ b/stable/traefik/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: traefik -version: 1.17.1 +version: 1.18.0 appVersion: 1.4.6 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support keywords: diff --git a/stable/traefik/README.md b/stable/traefik/README.md index 535acc3f26..57017bf970 100644 --- a/stable/traefik/README.md +++ b/stable/traefik/README.md @@ -98,6 +98,8 @@ The following tables lists the configurable parameters of the Traefik chart and | `rbac.enabled` | Whether to enable RBAC with a specific cluster role and binding for Traefik | `false` | | `nodeSelector` | Node labels for pod assignment | `{}` | | `tolerations` | List of node taints to tolerate | `[]` | +| `proxyProtocol.enabled` | Enable PROXY protocol support. | `false` | +| `proxyProtocol.trustedIPs` | List of proxy IPs (CIDR ranges) trusted to accurately convey the end-user IP. | `[]` | | `debug.enabled` | Turn on/off Traefik's debug mode. Enabling it will override the logLevel to `DEBUG` and provide `/debug/vars` endpoint that allows Go runtime stats to be inspected, such as number of Goroutines and memory stats | `false` | | `ssl.enabled` | Whether to enable HTTPS | `false` | | `ssl.enforced` | Whether to redirect HTTP requests to HTTPS | `false` | @@ -185,3 +187,13 @@ dashboard: basic: test: $apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/ ``` + +### Proxy Protocol + +In situations where Traefik lives behind an Internet-facing loadbalancer (like an AWS ELB) and you still want it to see the actual source IP of the visitor instead of the internal IP of the loadbalancer, you can enable the loadbalancer to use the Proxy protocol to talk to Traefik. This effectively makes the loadbalancer transparant, as Traefik will still get the actual visitor IP address for each request. This only works if Traefik knows it's receiving traffic via the Proxy Protocol and the loadbalancer IP addresses need to be whitelisted as well. + +How to set this up on AWS is described in the Kubernetes documentation [here](https://kubernetes.io/docs/concepts/services-networking/service/#proxy-protocol-support-on-aws), it can easily be done by adding an annotation to the Service definition. + +**Caution** + +If only one of the components (either the loadbalancer or traefik) is set to use the Proxy protocol and the other is not, this will break badly as they will not be able to communicate with each other. diff --git a/stable/traefik/templates/_helpers.tpl b/stable/traefik/templates/_helpers.tpl index 458fc1b0ce..9b019b59a0 100644 --- a/stable/traefik/templates/_helpers.tpl +++ b/stable/traefik/templates/_helpers.tpl @@ -7,3 +7,15 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- define "fullname" -}} {{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}} {{- end -}} + +{{/* +Create the block for the ProxyProtocol's Trusted IPs. +*/}} +{{- define "trustedips" -}} + trustedIPs = [ + {{- range $idx, $ips := .Values.proxyProtocol.trustedIPs }} + {{- if $idx }}, {{ end }} + {{- $ips | quote }} + {{- end -}} + ] +{{- end -}} diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml index f3095f1c35..a332d77b13 100644 --- a/stable/traefik/templates/configmap.yaml +++ b/stable/traefik/templates/configmap.yaml @@ -22,6 +22,10 @@ data: [entryPoints] [entryPoints.http] address = ":80" + {{- if .Values.proxyProtocol.enabled }} + [entryPoints.http.proxyProtocol] + {{ template "trustedips" . }} + {{- end }} compress = {{ .Values.gzip.enabled }} {{- if .Values.ssl.enforced }} [entryPoints.http.redirect] @@ -31,6 +35,10 @@ data: {{- if .Values.ssl.enabled }} [entryPoints.https] address = ":443" + {{- if .Values.proxyProtocol.enabled }} + [entryPoints.https.proxyProtocol] + {{ template "proxyprotocol" . }} + {{- end }} compress = {{ .Values.gzip.enabled }} [entryPoints.https.tls] [[entryPoints.https.tls.certificates]] diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml index eff2819032..996f42a808 100644 --- a/stable/traefik/values.yaml +++ b/stable/traefik/values.yaml @@ -24,6 +24,11 @@ tolerations: [] # namespaces: # - default # labelSelector: +proxyProtocol: + enabled: false + # trustedIPs is required when enabled + trustedIPs: + # - 10.0.0.0/8 ssl: enabled: false enforced: false