Skip to content

Feat: add non-nginx ingress support via X_FORWARDED_* header support for media-auth #826

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
centerionware opened this issue Mar 31, 2025 · 1 comment

Comments

@centerionware
Copy link

centerionware commented Mar 31, 2025

Feature Request

Is your feature request related to a problem or unsupported use case? Please describe.
AFAIK only nginx supports the HTTP_X_ORIGINAL_URL header which blocks traefik from working with media-auth.

Describe the solution you'd like
to fallback on HTTP_X_FORWARDED_PROTO, HTTP_X_FORWARDED_HOST, HTTP_X_FORWARDED_URI if they're found and HTTP_X_ORIGINAL_URL is not.

Describe alternatives you've considered
I don't want to switch my kubernetes ingress to nginx.

Discovery, Documentation, Adoption, Migration Strategy
Users will be able to host behind non-nginx ingresses

Do you want to work on it through a Pull Request?
I'll submit one tested working for me patch, if ya'll don't like the formatting or something ya'll feel free to modify it to your standards.

@centerionware
Copy link
Author

centerionware commented Mar 31, 2025

Traefik Middlewares
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
    name: media-bucket-regex
spec: 
  replacePathRegex:
    regex: ^/media/(.*)
    replacement: /impress-docs/$1
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: s3-host-sub
spec:
  headers:
    customRequestHeaders:
      HOST: "s3.example.com:192"
      Content-Security-Policy: "\"default-src 'none'\" always;"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
 name: media-auth
 namespace: docs
spec:
 forwardAuth:
    address: >-
      https://impress.example.com/api/v1.0/documents/media-auth/
    authResponseHeaders:
      - Authorization
      - X-Amz-Date
      - X-Amz-Content-SHA256
    trustForwardHeader: true

Used by adding the annotation to an ingressMedia definition:

traefik.ingress.kubernetes.io/router.middlewares: docs-media-auth@kubernetescrd,docs-media-bucket-regex@kubernetescrd,docs-s3-host-sub@kubernetescrd

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: No status
Development

No branches or pull requests

1 participant