Set `Forwarded` / `X-Forwarded-For` when proxying HTTP traffic
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 11.5k
- Forks
- 1.4k
- Avg merge
- 3d 22h
- Merged PRs (30d)
- 53
Description
## Feature Request
When the linkerd-proxy forwards an HTTP request, append a `Forwarded` or `X-Forwarded-For` header entry so that upstreams can tell where the forwarded request came from.
### What problem are you trying to solve?
It's common for HTTP services to log or consider the source-IP of incoming requests. For example, for rate-limiting or auditing. Usually external Load Balancers will set the `X-Forwarded-For` header, and Linkerd doesn't interfere with that. However for intra-cluster traffic (east/west), there is currently no good way for meshed services to learn the real source-IP of HTTP traffic, since the Linkerd proxy rewrites the source IP to 127.0.0.1.
### How should the problem be solved?
When the linkerd-proxy forwards an HTTP request, inject a `Forwarded` or `X-Forwarded-For` header.
This typically involves appending the IP to the list, if it already exists, like:
```
X-Forwarded-For: 1.1.1.1, 2.2.2.2
```
### Any alternatives you've considered?
It might be desirable to pick one of those headers, or to support both. `XFF` is universally supported. `Forwarded` is not (e.g. it's not supported in Django: https://code.djangoproject.com/ticket/30729).
### How would users interact with this feature?
Presumably this would be injected annotation config, something like
```
annotations:
config.linkerd.io/http-proxy-header: "x-forwarded-for" | "forwarded"
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names the linkerd-proxy HTTP forwarding path but no files, tests, or entry points. Start by resolving whether to support Forwarded, X-Forwarded-For, or both, and how the proposed annotation configuration should work. Done means the selected header is appended with the source IP when proxying HTTP traffic, including existing header values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100