linkerd / linkerd/linkerd2

Set `Forwarded` / `X-Forwarded-For` when proxying HTTP traffic

Open
#4,219 18 comments 30 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/proxy help wanted needs/design priority/triage
Dominant language
Go
Stars
11.5k
Forks
1.4k
Avg merge
3d 22h
Merged PRs (30d)
53

Description

## Feature Request

When the linkerd-proxy forwards an HTTP request, append a `Forwarded` or `X-Forwarded-For` header entry so that upstreams can tell where the forwarded request came from.

### What problem are you trying to solve?

It's common for HTTP services to log or consider the source-IP of incoming requests. For example, for rate-limiting or auditing. Usually external Load Balancers will set the `X-Forwarded-For` header, and Linkerd doesn't interfere with that. However for intra-cluster traffic (east/west), there is currently no good way for meshed services to learn the real source-IP of HTTP traffic, since the Linkerd proxy rewrites the source IP to 127.0.0.1.

### How should the problem be solved?

When the linkerd-proxy forwards an HTTP request, inject a `Forwarded` or `X-Forwarded-For` header.

This typically involves appending the IP to the list, if it already exists, like:

```
X-Forwarded-For: 1.1.1.1, 2.2.2.2
```

### Any alternatives you've considered?

It might be desirable to pick one of those headers, or to support both. `XFF` is universally supported. `Forwarded` is not (e.g. it's not supported in Django: https://code.djangoproject.com/ticket/30729).

### How would users interact with this feature?

Presumably this would be injected annotation config, something like

```
annotations:
config.linkerd.io/http-proxy-header: "x-forwarded-for" | "forwarded"
```

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names the linkerd-proxy HTTP forwarding path but no files, tests, or entry points. Start by resolving whether to support Forwarded, X-Forwarded-For, or both, and how the proposed annotation configuration should work. Done means the selected header is appended with the source IP when proxying HTTP traffic, including existing header values.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.