diff --git a/apis/v1alpha1/nginxproxy_types.go b/apis/v1alpha1/nginxproxy_types.go
index 79f274dcd6..fac34f0504 100644
--- a/apis/v1alpha1/nginxproxy_types.go
+++ b/apis/v1alpha1/nginxproxy_types.go
@@ -137,7 +137,7 @@ type RewriteClientIP struct {
// If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
// to start of array and select the first untrusted IP.
// For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
- // and TrustedAddresses is set to 55.55.55.1, NGINX will rewrite the client IP to 22.22.22.22.
+ // and TrustedAddresses is set to 55.55.55.1/32, NGINX will rewrite the client IP to 22.22.22.22.
// If disabled, NGINX will select the IP at the end of the array.
// In the previous example, 55.55.55.1 would be selected.
// Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
@@ -149,17 +149,17 @@ type RewriteClientIP struct {
// If a request comes from a trusted address, NGINX will rewrite the client IP information,
// and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
// If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
- // Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.21/24, fe80::1/128.
+ // TrustedAddresses only supports CIDR blocks: 192.33.21.1/24, fe80::1/64.
// To trust all addresses (not recommended for production), set to 0.0.0.0/0.
// If no addresses are provided, NGINX will not rewrite the client IP information.
// Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
// This field is required if mode is set.
// +kubebuilder:validation:MaxItems=16
- // +listType=set
+ // +listType=atomic
//
//
// +optional
- TrustedAddresses []TrustedAddress `json:"trustedAddresses,omitempty"`
+ TrustedAddresses []Address `json:"trustedAddresses,omitempty"`
}
// RewriteClientIPModeType defines how NGINX Gateway Fabric will determine the client's original IP address.
@@ -179,10 +179,27 @@ const (
RewriteClientIPModeXForwardedFor RewriteClientIPModeType = "XForwardedFor"
)
-// TrustedAddress is a string value representing a CIDR block or an IP address.
-// Examples: 10.0.0.2/32, 10.0.0.1, fe80::1/128, ::1/24.
-//
-// +kubebuilder:validation:Pattern=`^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$`
-//
-//nolint:lll
-type TrustedAddress string
+// Address is a struct that specifies address type and value.
+type Address struct {
+ // Type specifies the type of address.
+ // Default is "cidr" which specifies that the address is a CIDR block.
+ //
+ // +optional
+ // +kubebuilder:default:=cidr
+ Type AddressType `json:"type,omitempty"`
+
+ // Value specifies the address value.
+ //
+ // +optional
+ Value string `json:"value,omitempty"`
+}
+
+// AddressType specifies the type of address.
+// +kubebuilder:validation:Enum=cidr
+type AddressType string
+
+const (
+ // AddressTypeCIDR specifies that the address is a CIDR block.
+ // kubebuilder:validation:Pattern=`(\/([0-9]?[0-9]?[0-8]))$`
+ AddressTypeCIDR AddressType = "cidr"
+)
diff --git a/apis/v1alpha1/zz_generated.deepcopy.go b/apis/v1alpha1/zz_generated.deepcopy.go
index 42410e127b..bffbb7dfdb 100644
--- a/apis/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/v1alpha1/zz_generated.deepcopy.go
@@ -10,6 +10,21 @@ import (
"sigs.k8s.io/gateway-api/apis/v1alpha2"
)
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Address) DeepCopyInto(out *Address) {
+ *out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Address.
+func (in *Address) DeepCopy() *Address {
+ if in == nil {
+ return nil
+ }
+ out := new(Address)
+ in.DeepCopyInto(out)
+ return out
+}
+
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ClientBody) DeepCopyInto(out *ClientBody) {
*out = *in
@@ -483,7 +498,7 @@ func (in *RewriteClientIP) DeepCopyInto(out *RewriteClientIP) {
}
if in.TrustedAddresses != nil {
in, out := &in.TrustedAddresses, &out.TrustedAddresses
- *out = make([]TrustedAddress, len(*in))
+ *out = make([]Address, len(*in))
copy(*out, *in)
}
}
diff --git a/config/crd/bases/gateway.nginx.org_nginxproxies.yaml b/config/crd/bases/gateway.nginx.org_nginxproxies.yaml
index 904d7bb421..e1644b852d 100644
--- a/config/crd/bases/gateway.nginx.org_nginxproxies.yaml
+++ b/config/crd/bases/gateway.nginx.org_nginxproxies.yaml
@@ -84,7 +84,7 @@ spec:
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
to start of array and select the first untrusted IP.
For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
- and TrustedAddresses is set to 55.55.55.1, NGINX will rewrite the client IP to 22.22.22.22.
+ and TrustedAddresses is set to 55.55.55.1/32, NGINX will rewrite the client IP to 22.22.22.22.
If disabled, NGINX will select the IP at the end of the array.
In the previous example, 55.55.55.1 would be selected.
Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
@@ -95,20 +95,30 @@ spec:
If a request comes from a trusted address, NGINX will rewrite the client IP information,
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
- Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.21/24, fe80::1/128.
+ TrustedAddresses only supports CIDR blocks: 192.33.21.1/24, fe80::1/64.
To trust all addresses (not recommended for production), set to 0.0.0.0/0.
If no addresses are provided, NGINX will not rewrite the client IP information.
Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
This field is required if mode is set.
items:
- description: |-
- TrustedAddress is a string value representing a CIDR block or an IP address.
- Examples: 10.0.0.2/32, 10.0.0.1, fe80::1/128, ::1/24.
- pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
- type: string
+ description: Address is a struct that specifies address type
+ and value.
+ properties:
+ type:
+ default: cidr
+ description: |-
+ Type specifies the type of address.
+ Default is "cidr" which specifies that the address is a CIDR block.
+ enum:
+ - cidr
+ type: string
+ value:
+ description: Value specifies the address value.
+ type: string
+ type: object
maxItems: 16
type: array
- x-kubernetes-list-type: set
+ x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: if mode is set, trustedAddresses is a required field
diff --git a/deploy/crds.yaml b/deploy/crds.yaml
index c3631cd7c0..2b0ea4f133 100644
--- a/deploy/crds.yaml
+++ b/deploy/crds.yaml
@@ -669,7 +669,7 @@ spec:
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
to start of array and select the first untrusted IP.
For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
- and TrustedAddresses is set to 55.55.55.1, NGINX will rewrite the client IP to 22.22.22.22.
+ and TrustedAddresses is set to 55.55.55.1/32, NGINX will rewrite the client IP to 22.22.22.22.
If disabled, NGINX will select the IP at the end of the array.
In the previous example, 55.55.55.1 would be selected.
Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
@@ -680,20 +680,30 @@ spec:
If a request comes from a trusted address, NGINX will rewrite the client IP information,
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
- Addresses must be provided as CIDR blocks or IP addresses: 10.0.0.0, 192.33.21/24, fe80::1/128.
+ TrustedAddresses only supports CIDR blocks: 192.33.21.1/24, fe80::1/64.
To trust all addresses (not recommended for production), set to 0.0.0.0/0.
If no addresses are provided, NGINX will not rewrite the client IP information.
Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
This field is required if mode is set.
items:
- description: |-
- TrustedAddress is a string value representing a CIDR block or an IP address.
- Examples: 10.0.0.2/32, 10.0.0.1, fe80::1/128, ::1/24.
- pattern: ^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:\/(?:[0-9]|[12][0-9]|3[0-2]))?|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}(?:\/(?:[0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?)$
- type: string
+ description: Address is a struct that specifies address type
+ and value.
+ properties:
+ type:
+ default: cidr
+ description: |-
+ Type specifies the type of address.
+ Default is "cidr" which specifies that the address is a CIDR block.
+ enum:
+ - cidr
+ type: string
+ value:
+ description: Value specifies the address value.
+ type: string
+ type: object
maxItems: 16
type: array
- x-kubernetes-list-type: set
+ x-kubernetes-list-type: atomic
type: object
x-kubernetes-validations:
- message: if mode is set, trustedAddresses is a required field
diff --git a/internal/mode/static/nginx/config/servers_template.go b/internal/mode/static/nginx/config/servers_template.go
index 3c851457d2..80b0847e2e 100644
--- a/internal/mode/static/nginx/config/servers_template.go
+++ b/internal/mode/static/nginx/config/servers_template.go
@@ -13,8 +13,8 @@ server {
listen [::]:{{ $s.Listen }} ssl default_server{{ $.RewriteClientIP.ProxyProtocol }};
{{- end }}
ssl_reject_handshake on;
- {{- range $cidr := $.RewriteClientIP.RealIPFrom }}
- set_real_ip_from {{ $cidr }};
+ {{- range $address := $.RewriteClientIP.RealIPFrom }}
+ set_real_ip_from {{ $address }};
{{- end}}
{{- if $.RewriteClientIP.RealIPHeader}}
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
@@ -31,8 +31,8 @@ server {
{{- if $.IPFamily.IPv6 }}
listen [::]:{{ $s.Listen }} default_server{{ $.RewriteClientIP.ProxyProtocol }};
{{- end }}
- {{- range $cidr := $.RewriteClientIP.RealIPFrom }}
- set_real_ip_from {{ $cidr }};
+ {{- range $address := $.RewriteClientIP.RealIPFrom }}
+ set_real_ip_from {{ $address }};
{{- end}}
{{- if $.RewriteClientIP.RealIPHeader}}
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
@@ -77,8 +77,8 @@ server {
include {{ $i.Name }};
{{- end }}
- {{- range $cidr := $.RewriteClientIP.RealIPFrom }}
- set_real_ip_from {{ $cidr }};
+ {{- range $address := $.RewriteClientIP.RealIPFrom }}
+ set_real_ip_from {{ $address }};
{{- end}}
{{- if $.RewriteClientIP.RealIPHeader}}
real_ip_header {{ $.RewriteClientIP.RealIPHeader }};
diff --git a/internal/mode/static/nginx/config/stream_servers_template.go b/internal/mode/static/nginx/config/stream_servers_template.go
index 0a84e02338..58a95a70b0 100644
--- a/internal/mode/static/nginx/config/stream_servers_template.go
+++ b/internal/mode/static/nginx/config/stream_servers_template.go
@@ -10,8 +10,8 @@ server {
listen [::]:{{ $s.Listen }};
{{- end }}
- {{- range $cidr := $s.RewriteClientIP.RealIPFrom }}
- set_real_ip_from {{ $cidr }};
+ {{- range $address := $s.RewriteClientIP.RealIPFrom }}
+ set_real_ip_from {{ $address }};
{{- end}}
{{- if $.Plus }}
status_zone {{ $s.StatusZone }};
diff --git a/internal/mode/static/state/dataplane/configuration.go b/internal/mode/static/state/dataplane/configuration.go
index ce06c94b1e..eefe5e4bb4 100644
--- a/internal/mode/static/state/dataplane/configuration.go
+++ b/internal/mode/static/state/dataplane/configuration.go
@@ -863,7 +863,7 @@ func buildBaseHTTPConfig(g *graph.Graph) BaseHTTPConfig {
}
if len(g.NginxProxy.Source.Spec.RewriteClientIP.TrustedAddresses) > 0 {
- baseConfig.RewriteClientIPSettings.TrustedAddresses = convertTrustedAddresses(
+ baseConfig.RewriteClientIPSettings.TrustedAddresses = convertAddresses(
g.NginxProxy.Source.Spec.RewriteClientIP.TrustedAddresses,
)
}
@@ -894,10 +894,10 @@ func buildPolicies(graphPolicies []*graph.Policy) []policies.Policy {
return finalPolicies
}
-func convertTrustedAddresses(addresses []ngfAPI.TrustedAddress) []string {
+func convertAddresses(addresses []ngfAPI.Address) []string {
trustedAddresses := make([]string, len(addresses))
for i, addr := range addresses {
- trustedAddresses[i] = string(addr)
+ trustedAddresses[i] = addr.Value
}
return trustedAddresses
}
diff --git a/internal/mode/static/state/dataplane/configuration_test.go b/internal/mode/static/state/dataplane/configuration_test.go
index b1d6d98c54..a2ae5dc910 100644
--- a/internal/mode/static/state/dataplane/configuration_test.go
+++ b/internal/mode/static/state/dataplane/configuration_test.go
@@ -2198,8 +2198,13 @@ func TestBuildConfiguration(t *testing.T) {
Spec: ngfAPI.NginxProxySpec{
RewriteClientIP: &ngfAPI.RewriteClientIP{
SetIPRecursively: helpers.GetPointer(true),
- TrustedAddresses: []ngfAPI.TrustedAddress{"1.1.1.1/32"},
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
+ TrustedAddresses: []ngfAPI.Address{
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "1.1.1.1/32",
+ },
+ },
+ Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
},
},
},
@@ -3619,8 +3624,13 @@ func TestBuildRewriteIPSettings(t *testing.T) {
Source: &ngfAPI.NginxProxy{
Spec: ngfAPI.NginxProxySpec{
RewriteClientIP: &ngfAPI.RewriteClientIP{
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
- TrustedAddresses: []ngfAPI.TrustedAddress{"10.9.9.4"},
+ Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
+ TrustedAddresses: []ngfAPI.Address{
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "10.9.9.4/32",
+ },
+ },
SetIPRecursively: helpers.GetPointer(true),
},
},
@@ -3629,7 +3639,7 @@ func TestBuildRewriteIPSettings(t *testing.T) {
},
expRewriteIPSettings: RewriteClientIPSettings{
Mode: RewriteIPModeProxyProtocol,
- TrustedAddresses: []string{"10.9.9.4"},
+ TrustedAddresses: []string{"10.9.9.4/32"},
IPRecursive: true,
},
},
@@ -3641,8 +3651,13 @@ func TestBuildRewriteIPSettings(t *testing.T) {
Source: &ngfAPI.NginxProxy{
Spec: ngfAPI.NginxProxySpec{
RewriteClientIP: &ngfAPI.RewriteClientIP{
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
- TrustedAddresses: []ngfAPI.TrustedAddress{"76.89.90.11"},
+ Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
+ TrustedAddresses: []ngfAPI.Address{
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "76.89.90.11/24",
+ },
+ },
SetIPRecursively: helpers.GetPointer(true),
},
},
@@ -3651,7 +3666,7 @@ func TestBuildRewriteIPSettings(t *testing.T) {
},
expRewriteIPSettings: RewriteClientIPSettings{
Mode: RewriteIPModeXForwardedFor,
- TrustedAddresses: []string{"76.89.90.11"},
+ TrustedAddresses: []string{"76.89.90.11/24"},
IPRecursive: true,
},
},
@@ -3663,8 +3678,25 @@ func TestBuildRewriteIPSettings(t *testing.T) {
Source: &ngfAPI.NginxProxy{
Spec: ngfAPI.NginxProxySpec{
RewriteClientIP: &ngfAPI.RewriteClientIP{
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
- TrustedAddresses: []ngfAPI.TrustedAddress{"5.5.5.5", "1.1.1.1/32", "2.2.2.2/32", "3.3.3.3/24"},
+ Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeXForwardedFor),
+ TrustedAddresses: []ngfAPI.Address{
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "5.5.5.5/12",
+ },
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "1.1.1.1/26",
+ },
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "2.2.2.2/32",
+ },
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "3.3.3.3/24",
+ },
+ },
SetIPRecursively: helpers.GetPointer(false),
},
},
@@ -3673,7 +3705,7 @@ func TestBuildRewriteIPSettings(t *testing.T) {
},
expRewriteIPSettings: RewriteClientIPSettings{
Mode: RewriteIPModeXForwardedFor,
- TrustedAddresses: []string{"5.5.5.5", "1.1.1.1/32", "2.2.2.2/32", "3.3.3.3/24"},
+ TrustedAddresses: []string{"5.5.5.5/12", "1.1.1.1/26", "2.2.2.2/32", "3.3.3.3/24"},
IPRecursive: false,
},
},
diff --git a/internal/mode/static/state/graph/nginxproxy.go b/internal/mode/static/state/graph/nginxproxy.go
index 42993c1347..67d156791a 100644
--- a/internal/mode/static/state/graph/nginxproxy.go
+++ b/internal/mode/static/state/graph/nginxproxy.go
@@ -172,15 +172,12 @@ func validateRewriteClientIP(npCfg *ngfAPI.NginxProxy) field.ErrorList {
}
for _, addr := range rewriteClientIP.TrustedAddresses {
- cidrError := k8svalidation.IsValidCIDR(trustedAddressesPath, string(addr))
- ipError := k8svalidation.IsValidIP(trustedAddressesPath, string(addr))
-
- if cidrError != nil && ipError != nil {
+ if err := k8svalidation.IsValidCIDR(trustedAddressesPath, addr.Value); err != nil {
allErrs = append(
allErrs,
- field.Invalid(trustedAddressesPath.Child(string(addr)),
+ field.Invalid(trustedAddressesPath.Child(addr.Value),
addr,
- "must be a valid IP address or CIDR range",
+ err.ToAggregate().Error(),
),
)
}
diff --git a/internal/mode/static/state/graph/nginxproxy_test.go b/internal/mode/static/state/graph/nginxproxy_test.go
index 3df1347981..e5ecab47b8 100644
--- a/internal/mode/static/state/graph/nginxproxy_test.go
+++ b/internal/mode/static/state/graph/nginxproxy_test.go
@@ -2,7 +2,6 @@ package graph
import (
"errors"
- "fmt"
"testing"
. "github.com/onsi/gomega"
@@ -269,8 +268,17 @@ func TestValidateNginxProxy(t *testing.T) {
IPFamily: helpers.GetPointer[ngfAPI.IPFamilyType](ngfAPI.Dual),
RewriteClientIP: &ngfAPI.RewriteClientIP{
SetIPRecursively: helpers.GetPointer(true),
- TrustedAddresses: []ngfAPI.TrustedAddress{"2001:db8:a0b:12f0::1/32", "1.1.1.1"},
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
+ TrustedAddresses: []ngfAPI.Address{
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "2001:db8:a0b:12f0::1/32",
+ },
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "1.1.1.1/24",
+ },
+ },
+ Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
},
},
},
@@ -378,8 +386,17 @@ func TestValidateRewriteClientIP(t *testing.T) {
Spec: ngfAPI.NginxProxySpec{
RewriteClientIP: &ngfAPI.RewriteClientIP{
SetIPRecursively: helpers.GetPointer(true),
- TrustedAddresses: []ngfAPI.TrustedAddress{"2001:db8:a0b:12f0::1/32", "10.56.32.11/32"},
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
+ TrustedAddresses: []ngfAPI.Address{
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "2001:db8:a0b:12f0::1/32",
+ },
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "10.56.32.11/32",
+ },
+ },
+ Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
},
},
},
@@ -392,30 +409,25 @@ func TestValidateRewriteClientIP(t *testing.T) {
Spec: ngfAPI.NginxProxySpec{
RewriteClientIP: &ngfAPI.RewriteClientIP{
SetIPRecursively: helpers.GetPointer(true),
- TrustedAddresses: []ngfAPI.TrustedAddress{"2001:db8::/129", "10.0.0.1"},
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
+ TrustedAddresses: []ngfAPI.Address{
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "2001:db8::/129",
+ },
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "10.0.0.1/32",
+ },
+ },
+ Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
},
},
},
expectErrCount: 1,
errorString: "spec.rewriteClientIP.trustedAddresses.2001:db8::/129: " +
- "Invalid value: \"2001:db8::/129\": must be a valid IP address or CIDR range",
- },
- {
- name: "invalid IP and valid CIDR in trustedAddresses",
- validator: createInvalidValidator(),
- np: &ngfAPI.NginxProxy{
- Spec: ngfAPI.NginxProxySpec{
- RewriteClientIP: &ngfAPI.RewriteClientIP{
- SetIPRecursively: helpers.GetPointer(true),
- TrustedAddresses: []ngfAPI.TrustedAddress{"2001:db8::1/48", "256.100.50.25"},
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
- },
- },
- },
- expectErrCount: 1,
- errorString: "spec.rewriteClientIP.trustedAddresses.256.100.50.25: " +
- "Invalid value: \"256.100.50.25\": must be a valid IP address or CIDR range",
+ "Invalid value: v1alpha1.Address{Type:\"cidr\", Value:\"2001:db8::/129\"}: " +
+ "spec.rewriteClientIP.trustedAddresses: Invalid value: " +
+ "\"2001:db8::/129\": must be a valid CIDR value, (e.g. 10.9.8.0/24 or 2001:db8::/64)",
},
{
name: "invalid when mode is set and trustedAddresses is empty",
@@ -437,13 +449,28 @@ func TestValidateRewriteClientIP(t *testing.T) {
Spec: ngfAPI.NginxProxySpec{
RewriteClientIP: &ngfAPI.RewriteClientIP{
Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeProxyProtocol),
- TrustedAddresses: []ngfAPI.TrustedAddress{
- "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32",
- "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32",
- "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32",
- "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32",
- "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32",
- "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32", "2001:db8:a0b:12f0::1/32",
+ TrustedAddresses: []ngfAPI.Address{
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
+ {Type: ngfAPI.AddressTypeCIDR, Value: "2001:db8:a0b:12f0::1/32"},
},
},
},
@@ -457,8 +484,17 @@ func TestValidateRewriteClientIP(t *testing.T) {
np: &ngfAPI.NginxProxy{
Spec: ngfAPI.NginxProxySpec{
RewriteClientIP: &ngfAPI.RewriteClientIP{
- Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeType("invalid")),
- TrustedAddresses: []ngfAPI.TrustedAddress{"2001:db8:a0b:12f0::1/32", "10.0.0.1/32"},
+ Mode: helpers.GetPointer(ngfAPI.RewriteClientIPModeType("invalid")),
+ TrustedAddresses: []ngfAPI.Address{
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "2001:db8:a0b:12f0::1/32",
+ },
+ {
+ Type: ngfAPI.AddressTypeCIDR,
+ Value: "10.0.0.1/32",
+ },
+ },
},
},
},
@@ -490,7 +526,6 @@ func TestValidateRewriteClientIP(t *testing.T) {
allErrs := validateRewriteClientIP(test.np)
g.Expect(allErrs).To(HaveLen(test.expectErrCount))
if len(allErrs) > 0 {
- fmt.Println(allErrs.ToAggregate().Error())
g.Expect(allErrs.ToAggregate().Error()).To(Equal(test.errorString))
}
})
diff --git a/site/content/reference/api.md b/site/content/reference/api.md
index deb2eee011..b7e49011af 100644
--- a/site/content/reference/api.md
+++ b/site/content/reference/api.md
@@ -467,6 +467,76 @@ sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyStatus
+Address
+
+
+
+(Appears on:
+RewriteClientIP)
+
+
+
Address is a struct that specifies address type and value.
+
+
+
+
+| Field |
+Description |
+
+
+
+
+
+type
+
+
+AddressType
+
+
+ |
+
+(Optional)
+ Type specifies the type of address.
+Default is “cidr” which specifies that the address is a CIDR block.
+ |
+
+
+
+value
+
+string
+
+ |
+
+(Optional)
+ Value specifies the address value.
+ |
+
+
+
+AddressType
+(string alias)
+
+
+(Appears on:
+Address)
+
+
+
AddressType specifies the type of address.
+
+
+
+
+| Value |
+Description |
+
+
+"cidr" |
+AddressTypeCIDR specifies that the address is a CIDR block.
+kubebuilder:validation:Pattern=(\/([0-9]?[0-9]?[0-8]))$
+ |
+
+
ClientBody
@@ -1091,7 +1161,7 @@ the X-Forwarded-For header. It is used in conjunction with TrustedAddresses.
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
to start of array and select the first untrusted IP.
For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
-and TrustedAddresses is set to 55.55.55.1, NGINX will rewrite the client IP to 22.22.22.22.
+and TrustedAddresses is set to 55.55.55.1⁄32, NGINX will rewrite the client IP to 22.22.22.22.
If disabled, NGINX will select the IP at the end of the array.
In the previous example, 55.55.55.1 would be selected.
Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
@@ -1101,8 +1171,8 @@ Sets NGINX directive real_ip_recursive:
-[]TrustedAddress
+
+[]Address
@@ -1112,7 +1182,7 @@ Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
@@ -1491,17 +1561,6 @@ Examples of invalid names: some-$value, quoted-“value”-name, unescap
-TrustedAddress
-(string alias)
-
-
-(Appears on:
-RewriteClientIP)
-
-
-
TrustedAddress is a string value representing a CIDR block or an IP address.
-Examples: 10.0.0.2⁄32, 10.0.0.1, fe80::1⁄128, ::1⁄24.
-
Generated with gen-crd-api-reference-docs