You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "vichaos (via GitHub)" <gi...@apache.org> on 2025/11/14 10:03:09 UTC
[PR] feat: add configurable real_ip_header option for nginx [apisix-helm-chart]
vichaos opened a new pull request, #904:
URL: https://github.com/apache/apisix-helm-chart/pull/904
## Add configurable `real_ip_header` option for nginx configuration
### Summary
This PR makes the nginx `real_ip_header` directive configurable via `values.yaml`, allowing users to customize which header is used to extract the real client IP address.
### Changes
- Added `apisix.nginx.realIpHeader` configuration option in `values.yaml` with a default value of `"X-Real-IP"`
- Updated `configmap.yaml` template to use the configurable value instead of hardcoded `"X-Real-IP"`
- Maintains backward compatibility with existing deployments (default remains `"X-Real-IP"`)
### Why This Change is Necessary
Different deployment environments and proxy setups use different headers to pass the original client IP address:
1. **Load Balancer Variations**: Different cloud providers and load balancers use different headers:
- AWS ALB/ELB often uses `X-Forwarded-For`
- Cloudflare uses `CF-Connecting-IP`
- Google Cloud Load Balancer may use `X-Forwarded-For`
- Some proxies use `X-Real-IP` (current default)
2. **Multi-Layer Proxy Environments**: In complex deployments with multiple proxy layers (e.g., CDN → Load Balancer → Ingress → APISIX), the appropriate header may differ based on architecture.
3. **Security and Rate Limiting**: Correctly identifying client IPs is crucial for:
- Accurate rate limiting based on client IP
- Security plugins that rely on IP-based access control
- Logging and analytics
- Compliance requirements
4. **Flexibility**: Without this configuration option, users would need to either:
- Fork the chart and modify it
- Use post-deployment patches
- Accept incorrect IP detection in their environment
This change provides the flexibility needed for various deployment scenarios while maintaining sensible defaults.
### Usage Example
```yaml
apisix:
nginx:
realIpHeader: "X-Forwarded-For" # For AWS ALB/ELB environments
```
Or via Helm CLI:
```bash
helm install apisix . --set apisix.nginx.realIpHeader="CF-Connecting-IP"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add configurable real_ip_header option for nginx [apisix-helm-chart]
Posted by "vichaos (via GitHub)" <gi...@apache.org>.
vichaos commented on PR #904:
URL: https://github.com/apache/apisix-helm-chart/pull/904#issuecomment-3594452746
@ngclinflows Thanks for raising this. I’ve added support for the complementary apisix.nginx_config.http.real_ip_from parameter in the chart values so APISIX can properly trust the defined IPs/CIDRs for client address handling.
Feel free to review the update and let me know if I should refine anything further.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add configurable real_ip_header option for nginx [apisix-helm-chart]
Posted by "ngclinflows (via GitHub)" <gi...@apache.org>.
ngclinflows commented on PR #904:
URL: https://github.com/apache/apisix-helm-chart/pull/904#issuecomment-3580099099
Hi @vichaos,
I think you missed to add a chart value for the complementary `apisix.nginx_config.http.real_ip_from` APISIX config parameter: it allows to trust a set of IPs and/or CIDRs and then effectively replace properly client address in `$remote_addr` with the one provided in the `X-Real-IP`/`X-Forwarded-For`/`Forwarded` header
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add configurable real_ip_header option for nginx [apisix-helm-chart]
Posted by "juzhiyuan (via GitHub)" <gi...@apache.org>.
juzhiyuan closed pull request #904: feat: add configurable real_ip_header option for nginx
URL: https://github.com/apache/apisix-helm-chart/pull/904
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add configurable real_ip_header option for nginx [apisix-helm-chart]
Posted by "ngclinflows (via GitHub)" <gi...@apache.org>.
ngclinflows commented on code in PR #904:
URL: https://github.com/apache/apisix-helm-chart/pull/904#discussion_r2564013041
##########
charts/apisix/values.yaml:
##########
@@ -418,6 +418,9 @@ apisix:
enableCPUAffinity: true
# -- Timeout during which a keep-alive client connection will stay open on the server side.
keepaliveTimeout: 60s
+ # -- The name of the header from which to extract the real client IP address
+ # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
+ realIpHeader: "X-Real-IP"
envs: []
Review Comment:
```suggestion
# -- Defines trusted addresses that are known to send correct replacement addresses.
# http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
realIpFrom:
- 127.0.0.1
- 'unix:'
envs: []
```
##########
charts/apisix/templates/configmap.yaml:
##########
@@ -202,7 +202,7 @@ data:
client_body_timeout: 60s # timeout for reading client request body, then 408 (Request Time-out) error is returned to the client
send_timeout: 10s # timeout for transmitting a response to the client.then the connection is closed
underscores_in_headers: "on" # default enables the use of underscores in client request header fields
- real_ip_header: "X-Real-IP" # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
+ real_ip_header: {{ .Values.apisix.nginx.realIpHeader | quote }} # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
real_ip_from: # http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
- 127.0.0.1
- 'unix:'
Review Comment:
```suggestion
real_ip_from: # http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
{{- if .Values.apisix.nginx.realIpFrom }}
{{- toYaml .Values.apisix.nginx.realIpFrom | nindent 10 }}
{{- else }}
- 127.0.0.1
- 'unix:'
{{- end }}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add configurable real_ip_header option for nginx [apisix-helm-chart]
Posted by "ngclinflows (via GitHub)" <gi...@apache.org>.
ngclinflows commented on PR #904:
URL: https://github.com/apache/apisix-helm-chart/pull/904#issuecomment-3602918391
Seems good to me 👍
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org