Azure Front Door+Ingress-Nginx环境下Keycloak无法获取客户端源IP排查

问题说明 #

我在Kubernetes上部署了Keycloak实例，用户访问链路为Azure Front Door -> Ingress-Nginx -> Kubernetes。目前Keycloak显示的是Azure Front Door的IP，而非客户端真实源IP。已确认Keycloak配置无问题，问题大概率出在Front Door与Ingress-Nginx的配置环节，请求帮忙排查。

现有配置 #

Ingress注释配置 #

ingress:
  annotations:
    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
    # nginx.ingress.kubernetes.io/proxy-add-original-forwarded-for: "true"
    # nginx.ingress.kubernetes.io/forwarded-for-header: "michele"
    # nginx.ingress.kubernetes.io/real-ip-header: "X-Forwarded-For"

Nginx-Ingress设置配置 #

settings = [
    {
      name  = "controller.ingressClassResource.name"
      value = "nginx-external-frontdoor"
      type  = "string"
    },
    {
      name  = "controller.ingressClassResource.controllerValue"
      value = "k8s.io/ingress-nginx-external-frontdoor"
      type  = "string"
    },

    {
      name  = "controller.service.type"
      value = "LoadBalancer"
      type  = "string"
    },
    {
      name  = "controller.service.externalTrafficPolicy"
      value = "Local"
      type  = "string"
    }
  ]
}

修复方案 #

1. 调整Ingress注释配置

   • 取消注释nginx.ingress.kubernetes.io/real-ip-header: "X-Forwarded-For"，让Nginx从X-Forwarded-For头中提取真实客户端IP
   • 取消注释nginx.ingress.kubernetes.io/proxy-add-original-forwarded-for: "true"，确保Nginx将原始客户端IP追加到转发头中
   • 注释掉nginx.ingress.kubernetes.io/forwarded-for-header: "michele"，使用默认的X-Forwarded-For即可，自定义名称会导致解析失败

2. 添加Nginx信任Azure Front Door IP段
   在Nginx-Ingress的settings中新增以下配置，指定Azure Front Door的出口IP范围，让Nginx信任这些代理IP，才能正确解析转发头中的真实IP：

   {
     name  = "controller.config.proxy-real-ip-cidr"
     value = "13.107.6.0/24,13.107.128.0/22,13.107.192.0/18,104.42.0.0/15,40.90.0.0/16,40.112.0.0/14,20.189.128.0/18,20.224.0.0/12"
     type  = "string"
   }
   

   注：以上IP段为Azure Front Door官方公布的出口IP，可根据Azure官方文档实时更新

3. 验证Front Door转发配置
   确认Azure Front Door已启用X-Forwarded-For和X-Forwarded-Proto头的转发功能，确保客户端IP能被正确传递到Ingress-Nginx

内容的提问来源于stack exchange，提问作者Michele