Ingress controller
If an Ingress Controller is used as an MTLS Gateway for the Device Portal and additional security functions such as IP blocking of the Device Tunnel Service are to be activated, it must be ensured that the client IP of the incoming requests is preserved and the X-Forwarded-For header is set correctly.
Ingress nginx controller
If the Ingress Nginx Controller is used as Ingress Controller, there are different things to consider depending on the upstream load balancer or proxy.
-
In case of an upstream layer 7 Proxy or Load Balancer that sets the X-Forwarded-For header, the Ingress Nginx Controller uses the content of this header by default. However it might be necessary to configure the proxy-real-ip-cidr
-
In case of an upstream layer 4 Proxy or Load Balancer you must ensure that the client Ip is preserved when forwarding traffic to the Ingress Nginx Controller. For that you can either:
-
Set the K8S spec service.spec.externalTrafficPolicy to "Local". More Information here
-
Or use the Proxy Protocol for forwarding traffic which will send the connection details before forwarding the actual TCP connection itself.
-