Allow opt-in for informational headers
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 11.5k
- Forks
- 1.4k
- Avg merge
- 3d 22h
- Merged PRs (30d)
- 53
Description
https://github.com/linkerd/linkerd2/issues/2597 describes how, when an https ingress is configured, the inbound proxy is skipped in favor of TCP forwarding, so the headers set by the outbound proxy are not properly scrubbed, and ingress routers typically forward them blindly to external clients.
We should allow applications to opt-in to these headers at inject-time, and we should enable this by default for the control plane.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with linked issue #2597 to understand the HTTPS ingress and header-scrubbing behavior. Trace where injection-time options are handled and how the control plane is configured; done means applications can opt in to the informational headers and the control plane enables them by default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100