How do I make Traefik pass on the x-forwarded-proto header?

user_16873952 0
Viewed 1652

I am deploying Traefik on my EKS cluster via the default Traefik Helm chart and I am also using the AWS Load Balancer Controller.

Traefik deploys fine and routes traffic to my services. However, one of the customers services has a requirement for the x-forwarded-proto header to passed to it. This is so it knows whether user originally came in via http or https.

The AWS ALB is sending in the header but Traefik doesn't forward it on. Anybody know how to make Traefik do this?

How I install Traefik: helm install traefik traefik/traefik --values=values.yaml

aws-application-load-balancer traefik-ingress amazon-eks traefik kubernetes
1 Answers

With traefik, you have to trust external proxies addresses, to preserve their X-Forwarded-For header.

This would be done adding an argument such as --entryPoints.websecure.forwardedHeaders.trustedIPs=127.0.0.1/32,W.X.Y.Z/32

Using Helm, you should be able to use:

helm install .... "--set=additionalArguments=['--entryPoints.websecure.forwardedHeaders.trustedIPs=127.0.0.1/32,10.42.0.0/16']"`

... or write your own values file.

WARNING: by default the Chart would not use configure hostNetwork, and rather expose your ingress using a LoadBalancer service (actually based on a NodePort).

The NodePort behavior is to NAT the connection entering the SDN. As such, Traefik would see some internal SDN address -- depending on which SDN you are using, it could be the first usable address of an host subnet, the network address of that host subnet, the IP for your kubernetes node out of the SDN, ... You would have to figure out which IP to trust, depending on your setup.

user_56072070
Related