mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Aleksei Sviridkin
8df4b0b0f1
Expose a proxyProtocol value on the Ingress application that turns on ingress-nginx use-proxy-protocol with real-ip-header=proxy_protocol and enable-real-ip. The host control plane also enables it through the _cluster.proxy-protocol switch, applied only to the external-facing ingress (the namespace named by expose-ingress). use-forwarded-headers / compute-full-forwarded-for are deliberately not set: without a paired proxy-real-ip-cidr they let clients spoof X-Forwarded-For, and the PROXY-protocol frame is already the source of truth for the client address. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
Ingress-NGINX Controller
Parameters
Common parameters
| Name | Description | Type | Value |
|---|---|---|---|
replicas |
Number of ingress-nginx replicas. | int |
2 |
whitelist |
List of client networks. | []string |
[] |
cloudflareProxy |
Restoring original visitor IPs when Cloudflare proxied is enabled. | bool |
false |
proxyProtocol |
Enable PROXY-protocol (use-proxy-protocol) on a tenant Ingress application. The upstream L4 load balancer in front of ingress-nginx MUST already inject PROXY-protocol v1 headers, otherwise all traffic to this ingress breaks — including in-cluster and direct-Service (hairpin) access to its public hostnames. Mutually exclusive with cloudflareProxy. For the host (external-facing) ingress use the platform-level publishing.proxyProtocol switch instead; the per-app value is rejected there because it would bypass the ouroboros hairpin handling and the disable-hazard guard. | bool |
false |
resources |
Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in resourcesPreset is applied. |
object |
{} |
resources.cpu |
CPU available to each replica. | quantity |
"" |
resources.memory |
Memory (RAM) available to each replica. | quantity |
"" |
resourcesPreset |
Default sizing preset used when resources is omitted. |
string |
t1.micro |