feat: add configurable real_ip_header option for nginx

charts/apisix/README.md

@@ -105,6 +105,8 @@ The command removes all the Kubernetes components associated with the chart and
 | apisix.nginx.logs.errorLog | string | `"/dev/stderr"` | Error log path |
 | apisix.nginx.logs.errorLogLevel | string | `"warn"` | Error log level |
 | apisix.nginx.luaSharedDicts | list | `[]` | Override default [lua_shared_dict](https://github.com/apache/apisix/blob/master/conf/config.yaml.example#L250-L276) settings, click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict |
+| apisix.nginx.realIpFrom | list | `["127.0.0.1","unix:"]` | Defines trusted addresses that are known to send correct replacement addresses. http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from |
+| apisix.nginx.realIpHeader | string | `"X-Real-IP"` | The name of the header from which to extract the real client IP address http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header |
 | apisix.nginx.workerConnections | string | `"10620"` |  |
 | apisix.nginx.workerProcesses | string | `"auto"` |  |
 | apisix.nginx.workerRlimitNofile | string | `"20480"` |  |

charts/apisix/templates/configmap.yaml

@@ -207,10 +207,14 @@ data:
         client_body_timeout: 60s       # timeout for reading client request body, then 408 (Request Time-out) error is returned to the client
         send_timeout: 10s              # timeout for transmitting a response to the client.then the connection is closed
         underscores_in_headers: "on"   # default enables the use of underscores in client request header fields
-        real_ip_header: "X-Real-IP"    # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
+        real_ip_header: {{ .Values.apisix.nginx.realIpHeader | quote }}    # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
         real_ip_from:                  # http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
+        {{- if .Values.apisix.nginx.realIpFrom }}
+          {{- toYaml .Values.apisix.nginx.realIpFrom | nindent 10 }}
+        {{- else }}
           - 127.0.0.1
           - 'unix:'
+        {{- end }}
         {{- if .Values.apisix.nginx.customLuaSharedDicts }}
         custom_lua_shared_dict:        # add custom shared cache to nginx.conf
         {{- range $dict := .Values.apisix.nginx.customLuaSharedDicts }}

charts/apisix/values.yaml

@@ -418,6 +418,14 @@ apisix:
     enableCPUAffinity: true
     # -- Timeout during which a keep-alive client connection will stay open on the server side.
     keepaliveTimeout: 60s
+    # -- The name of the header from which to extract the real client IP address
+    # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
+    realIpHeader: "X-Real-IP"
+    # -- Defines trusted addresses that are known to send correct replacement addresses.
+    # http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
+    realIpFrom:
+      - 127.0.0.1
+      - 'unix:'
     envs: []
     # access log and error log configuration
     logs: