如何配置 NGINX 入口控制器以与 Cloudflare 和 Digital Ocean Load Balancer 一起使用？

Question

我试过 this question 中的答案。这是我当前的配置：

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    helm.sh/chart: ingress-nginx-2.13.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: 0.35.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
  namespace: ingress-nginx
data:
  use-proxy-protocol: 'true'
  enable-real-ip: "true"
  proxy-real-ip-cidr: "173.245.48.0/20,173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,172.64.0.0/13,131.0.72.0/22,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32"
  # use-forwarded-headers: "true"
  # compute-full-forwarded-for: "true"
  # forwarded-for-header: "Cf-Connecting-Ip"
  # forwarded-for-header: "X-Original-Forwarded-For"
  server-snippet: |
    real_ip_header CF-Connecting-IP;

而我试过的none配置实际上是将原始IP作为真实IP。

在应用配置之前，我得到：

Host: example.com
X-Request-ID: deadcafe
X-Real-IP: 162.158.X.X (A Cloudflare IP)
X-Forwarded-For: 162.158.X.X (Same as above)
X-Forwarded-Proto: https
X-Forwarded-Host: example.com
X-Forwarded-Port: 80
X-Scheme: https
X-Original-Forwarded-For: <The Originating IP that I want>
Accept-Encoding: gzip
CF-IPCountry: IN
CF-RAY: cafedeed
CF-Visitor: {"scheme":"https"}
user-agent: Mozilla/5.0 
accept-language: en-US,en;q=0.5
referer: https://pv-hr.jptec.in/
upgrade-insecure-requests: 1
cookie: __cfduid=012dadfad
CF-Request-ID: 01234faddad
CF-Connecting-IP: <The Originating IP that I want>
CDN-Loop: cloudflare

应用配置映射后，headers 是：

Host: example.com
X-Request-ID: 0123fda
X-Real-IP: 10.X.X.X (An IP that matches the private ip of the Digital Ocean droplets in the vpc, so guessing its the load balancer)
X-Forwarded-For: 10.X.X.X (Same as above)
X-Forwarded-Proto: http
X-Forwarded-Host: example.com
X-Forwarded-Port: 80
X-Scheme: http
X-Original-Forwarded-For: <Originating IP>
Accept-Encoding: gzip
CF-IPCountry: US
CF-RAY: 5005deeb
CF-Visitor: {"scheme":"https"}
accept: /
user-agent: Mozilla/5.0
CF-Request-ID: 1EE7af
CF-Connecting-IP: <Originating IP>
CDN-Loop: cloudflare

所以配置后唯一的变化是 real-ip 现在指向 Digital Ocean vpc 上的一些内部资源。我无法追踪到它，但我猜它是负载均衡器。我确信它是一个 DO 资源，因为它与 kubernetes 节点的 ip 相匹配。所以，我不太确定为什么会这样，以及我应该怎么做才能将原始 ip 作为真实 ip。

Answer 1

您遇到的问题在这里：

proxy-real-ip-cidr: "173.245.48.0/20,173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,172.64.0.0/13,131.0.72.0/22,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32"

但是，所看到的流量来自您的 DO LB，而不是 10.x.x.x。这导致它被这条规则忽略。

我执行了以下操作以使其正常运行：

apiVersion: v1
data:
  enable-real-ip: "true"
  server-snippet: |
    real_ip_header CF-Connecting-IP;
kind: ConfigMap
metadata:
[...]

安全通知：这将适用于所有流量，即使它不是来自 Cloudflare 本身。因此，有人可以在请求中欺骗 headers 来冒充另一个 IP 地址。

Answer 2

我遇到了同样的问题，above-accepted 答案对我没有帮助。

这是我解决问题的方法：

#1 - 在 ingress-nginx-controller 中，我添加了以下注释：

# The below will instruct DO LOadBalancer to pass CloudFlare Ips to ingress insted of DO LoadBalancer IPs
service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: 'true'

#2 - 在 Config Maps 中 ingress-nginx-controller 我在数据中添加了以下内容：这里我们也设置 use-proxy-protocol 添加 set_real_ip_from (ClouDFlares Ips) server-snippet 可以如下所示或#real_ip_header X-Forwarded-For；见 for more

请使用此 link 获取更新的 cloudflare Ips 列表

data:
  use-proxy-protocol: 'true'
  server-snippet: 'real_ip_header CF-Connecting-IP;'
  set_real_ip_from: '173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32'

如何配置 NGINX 入口控制器以与 Cloudflare 和 Digital Ocean Load Balancer 一起使用？

How can I configure NGINX ingress controller to work with Cloudflare and Digital Ocean Load Balancer?

cloudflare

digital-ocean

kubernetes

kubernetes-ingress

nginx-ingress