启用NLB代理协议导致Nginx入口控制器抛出错误请求

yr9zkbsy  于 2024-01-06  发布在  Nginx
关注(0)|答案(1)|浏览(183)

我有一个托管在AWS(EKS)中的Kubernetes集群。
我正在尝试保留客户端的IP。为此,我尝试在集群前面的网络负载均衡器中启用代理协议v2,并配置Nginx ingress控制器来处理它。
尽管如此,我还是收到了一个坏的请求错误,每个请求都没有任何额外的信息。
这是我的Nginx ingress控制器

  1. apiVersion: v1
  2. data:
  3. allow-snippet-annotations: "true"
  4. compute-full-forwarded-for: "true"
  5. enable-real-ip: "true"
  6. server-snippet: "listen 8000;\nif ( $server_port = 80 ) {\n return 308 https://$host$request_uri;\n}
  7. \ \n"
  8. ssl-redirect: "false"
  9. use-forwarded-headers: "true"
  10. use-proxy-protocol: "true"

字符串
这在Nginx配置中转换为

  1. ## start server
  2. server {
  3. server_name [REDACTED] ;
  4. listen 80 proxy_protocol ;
  5. listen 443 proxy_protocol ssl http2 ;
  6. set $proxy_upstream_name "-";
  7. ssl_certificate_by_lua_block {
  8. certificate.call()
  9. }
  10. location / {
  11. set $namespace "[REDACTED]";
  12. set $ingress_name "[REDACTED]";
  13. set $service_name "[REDACTED]";
  14. set $service_port "[REDACTED]";
  15. set $location_path "/";
  16. set $global_rate_limit_exceeding n;
  17. rewrite_by_lua_block {
  18. lua_ingress.rewrite({
  19. force_ssl_redirect = false,
  20. ssl_redirect = false,
  21. force_no_ssl_redirect = false,
  22. preserve_trailing_slash = false,
  23. use_port_in_redirects = false,
  24. global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
  25. })
  26. balancer.rewrite()
  27. plugins.run()
  28. }
  29. header_filter_by_lua_block {
  30. lua_ingress.header()
  31. plugins.run()
  32. }
  33. body_filter_by_lua_block {
  34. plugins.run()
  35. }
  36. log_by_lua_block {
  37. balancer.log()
  38. monitor.call()
  39. plugins.run()
  40. }
  41. port_in_redirect off;
  42. set $balancer_ewma_score -1;
  43. set $proxy_upstream_name "[REDACTED]";
  44. set $proxy_host $proxy_upstream_name;
  45. set $pass_access_scheme $scheme;
  46. set $pass_server_port $proxy_protocol_server_port;
  47. set $best_http_host $http_host;
  48. set $pass_port $pass_server_port;
  49. set $proxy_alternative_upstream_name "";
  50. client_max_body_size 20m;
  51. proxy_set_header Host $best_http_host;
  52. # Allow websocket connections
  53. proxy_set_header Upgrade $http_upgrade;
  54. proxy_set_header Connection $connection_upgrade;
  55. proxy_set_header X-Request-ID $req_id;
  56. proxy_set_header X-Real-IP $remote_addr;
  57. proxy_set_header X-Forwarded-For $full_x_forwarded_for;
  58. proxy_set_header X-Forwarded-Host $best_http_host;
  59. proxy_set_header X-Forwarded-Port $pass_port;
  60. proxy_set_header X-Forwarded-Proto $pass_access_scheme;
  61. proxy_set_header X-Forwarded-Scheme $pass_access_scheme;
  62. proxy_set_header X-Scheme $pass_access_scheme;
  63. # Pass the original X-Forwarded-For
  64. proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
  65. proxy_set_header Proxy "";
  66. proxy_connect_timeout 5s;
  67. proxy_send_timeout 3600s;
  68. proxy_read_timeout 3600s;
  69. proxy_buffering off;
  70. proxy_buffer_size 4k;
  71. proxy_buffers 4 4k;
  72. proxy_max_temp_file_size 1024m;
  73. proxy_request_buffering on;
  74. proxy_http_version 1.1;
  75. proxy_cookie_domain off;
  76. proxy_cookie_path off;
  77. proxy_next_upstream error timeout;
  78. proxy_next_upstream_timeout 0;
  79. proxy_next_upstream_tries 3;
  80. proxy_pass http://upstream_balancer;
  81. proxy_redirect off;
  82. }
  83. # Custom code snippet configured in the configuration configmap
  84. listen 8000;
  85. if ( $server_port = 80 ) {
  86. return 308 https://$host$request_uri;
  87. }
  88. }
  89. ## end server


代理协议v2通过AWS控制台在我的HTTP目标组中启用,但当我访问服务的任何端点时,结果是

  1. <html>
  2. <head>
  3. <title>400 Bad Request</title>
  4. </head>
  5. <body>
  6. <center>
  7. <h1>400 Bad Request</h1>
  8. </center>
  9. <hr>
  10. <center>nginx</center>
  11. </body>
  12. </html>


任何帮助将是伟大的。
先谢了。

ftf50wuq

ftf50wuq1#

要配置NGINX接受PROXY协议头,请将proxy_protocol参数添加到http {}stream {}块中服务器块的listen指令中。https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/

  • 添加下面为我工作
  1. http {
  2. server {
  3. listen 80 proxy_protocol;
  4. }
  5. }

字符串

相关问题