Repository navigation
fix(ingress): trust CF-Connecting-IP only from Cloudflare ranges - #4444
Merged
Aleksei Sviridkin (lexfrei) merged 1 commit intoSep 24, 2026
Merged
Conversation
cloudflareProxy passed the Cloudflare ranges to the controller under set_real_ip_from, which is an nginx directive and not an ingress-nginx ConfigMap key, so the controller dropped it without a warning. With use-forwarded-headers on, the realip module then trusted every source from the default proxy-real-ip-cidr of 0.0.0.0/0, and any client that reached the load balancer directly could set CF-Connecting-IP to an address of its choice. That address is what whitelist-source-range checks, so the tenant whitelist, and any per-Ingress one, could be walked past with one header. proxy-real-ip-cidr is the key the controller reads for the trusted ranges. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Repository: cozystack/cozystack/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
area/networking
1 of 12 tasks
Aleksei Sviridkin (lexfrei)
added
the
kind/backport
Aleksei Sviridkin (lexfrei)
marked this pull request as ready for review
September 24, 2026 13:08
IvanHunters
approved these changes
Sep 24, 2026
Aleksei Sviridkin (lexfrei)
deleted the
fix/ingress-cloudflare-real-ip-cidr
branch
September 24, 2026 13:10
|
Successfully created backport PR for |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
With
cloudflareProxy: trueon a tenant Ingress app, any client that reaches the load balancer directly can pick its own source address by sending aCF-Connecting-IPheader, and that address is whatwhitelist-source-rangechecks. So the tenantwhitelist, and any per-Ingress whitelist behind the same controller, can be bypassed with one header.The chart passes the Cloudflare ranges to the controller as
set_real_ip_from. That is an nginx directive, not an ingress-nginx ConfigMap key, so the controller drops it without a warning.use-forwarded-headers: "true"turns the realip module on, and it then trusts every source from the defaultproxy-real-ip-cidr, which is0.0.0.0/0(ingress-nginx v1.11.5,internal/ingress/controller/config/config.goand theset_real_ip_fromloop innginx.tmpl). This has been the case since the option was added.The fix renames the key to
proxy-real-ip-cidr. Traffic that comes through Cloudflare keeps the visitor address as before. A direct connection keeps its own address, whatever it puts in the header. If something between Cloudflare and the controller rewrites the source address, the header stops being trusted and the whitelist sees that hop instead; that is the correct result for a header that can only be trusted from known senders.The new test checks that the trusted ranges land under the key the controller reads, that they are not a catch-all, and that
set_real_ip_fromis gone.Screenshots
No UI change.
Downstream repositories
Template-only change in
packages/extra/ingress: no values key, schema, package, platform, installer orhack/change, so nothing in the trigger map is reached.Release note
Summary by CodeRabbit