envoyproxy / envoyproxy/gateway

envoy-gateway: Additional configuration for determining internal address

Open
#3,598 7 comments 0 reactions 1 assignee Claimed by @cskarby View on GitHub
help wanted
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*
The http request header `x-forwarded-for` (XFF) is not beeing set when the request is origination from ip-ranges that envoy detects as internal. By default any request from private ip ranges ([RFC1918](https://datatracker.ietf.org/doc/html/rfc1918) / [RFC4193](https://datatracker.ietf.org/doc/html/rfc4193)) are considered internal. Envoy's list of internal CIDR ranges can be configured with the [internal address configuration](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-internaladdressconfig) in the http connection manager.

When running the envoy gateway in an internal network, where the client will connect directly to the envoy-gateway without network address translation from a private ip addresses, it would still be interesting to know the client's IP address. When the XFF header is not set, the backend will only have the ip address of the proxying gateway, and not the actual client.

Please provide guidance for how to configure the envoy-gateway with custom CIDR ranges to consider as internal. Ideally it should be possible to set this via helm values, or at least via relevant kubernetes configuration objects. In the meantime I would also be interested in ways to configure this via low level interfaces, e.g. [overriding the bootstrap configuration](https://gateway.envoyproxy.io/latest/tasks/operations/customize-envoyproxy/#customize-envoyproxy-bootstrap-config) or any other way, if that is possible?

*Relevant Links*
- API spec [HttpConnectionManager.InternalAddressConfig](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-internaladdressconfig)
- Upstream issue [envoyproxy/envoy#19844](https://github.com/envoyproxy/envoy/issues/19844)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.