mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-29 16:17:20 +09:00
Aleksei Sviridkin
3800f63513
cloudflareProxy passed the Cloudflare ranges to the controller under set_real_ip_from, which is an nginx directive and not an ingress-nginx ConfigMap key, so the controller dropped it without a warning. With use-forwarded-headers on, the realip module then trusted every source from the default proxy-real-ip-cidr of 0.0.0.0/0, and any client that reached the load balancer directly could set CF-Connecting-IP to an address of its choice. That address is what whitelist-source-range checks, so the tenant whitelist, and any per-Ingress one, could be walked past with one header. proxy-real-ip-cidr is the key the controller reads for the trusted ranges. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
Ingress-NGINX Controller
Parameters
Common parameters
| Name | Description | Type | Value |
|---|---|---|---|
replicas |
Number of ingress-nginx replicas. | int |
2 |
whitelist |
List of client networks. | []string |
[] |
cloudflareProxy |
Restoring original visitor IPs when Cloudflare proxied is enabled. | bool |
false |
proxyProtocol |
Enable PROXY-protocol (use-proxy-protocol) on a tenant Ingress application. The upstream L4 load balancer in front of ingress-nginx MUST already inject PROXY-protocol v1 headers, otherwise all traffic to this ingress breaks — including in-cluster and direct-Service (hairpin) access to its public hostnames. Mutually exclusive with cloudflareProxy. For the host (external-facing) ingress use the platform-level publishing.proxyProtocol switch instead; the per-app value is rejected there because it would bypass the ouroboros hairpin handling and the disable-hazard guard. | bool |
false |
resources |
Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in resourcesPreset is applied. |
object |
{} |
resources.cpu |
CPU available to each replica. | quantity |
"" |
resources.memory |
Memory (RAM) available to each replica. | quantity |
"" |
resourcesPreset |
Default sizing preset used when resources is omitted. |
string |
t1.micro |