Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed configuration error discarding forwarded headers from upstream #254

Merged
merged 1 commit into from
Nov 4, 2021

Conversation

Xitric
Copy link
Contributor

@Xitric Xitric commented Nov 4, 2021

This pull request addresses what I believe to be an issue in the Traefik configuration of the AKS secure baseline.

In the configuration, when whitelisting upstream IP addresses for forwarded headers, the configuration incorrectly references the non-existent entrypoint web, when it should instead refer to websecure.

Please feel free to close this PR if I am mistaken, but we have not been able to get forwarded headers to work without changing the configuration to reference websecure. Specifically, when using the current configuration of the baseline, our workloads in AKS do not receive the upstream header X-Forwarded-Host, but when changing the configuration to websecure, the header is forwarded correctly.

Copy link
Member

@ckittel ckittel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're spot on, thanks! There was a naming change there I think we missed a (long) while back.

@ckittel ckittel merged commit 853ccd9 into mspnp:main Nov 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants