{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/ingress/issues/727","repository_url":"https://api.github.com/repos/kubernetes/ingress","labels_url":"https://api.github.com/repos/kubernetes/ingress/issues/727/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/ingress/issues/727/comments","events_url":"https://api.github.com/repos/kubernetes/ingress/issues/727/events","html_url":"https://github.com/kubernetes/ingress/issues/727","id":229409045,"number":727,"title":"[nginx] whitelist-source-range doesn’t work on ssl port","user":{"login":"cheungpat","id":170071,"avatar_url":"https://avatars3.githubusercontent.com/u/170071?v=3","gravatar_id":"","url":"https://api.github.com/users/cheungpat","html_url":"https://github.com/cheungpat","followers_url":"https://api.github.com/users/cheungpat/followers","following_url":"https://api.github.com/users/cheungpat/following{/other_user}","gists_url":"https://api.github.com/users/cheungpat/gists{/gist_id}","starred_url":"https://api.github.com/users/cheungpat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cheungpat/subscriptions","organizations_url":"https://api.github.com/users/cheungpat/orgs","repos_url":"https://api.github.com/users/cheungpat/repos","events_url":"https://api.github.com/users/cheungpat/events{/privacy}","received_events_url":"https://api.github.com/users/cheungpat/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2017-05-17T16:12:25Z","updated_at":"2017-05-21T00:27:28Z","closed_at":null,"body":"It appears that the setting `whitelist-source-range` on an ingress does not work as expected on the 443 port but it does work on the 80 port.\r\n\r\nThe ingress controller is running in GKE with Kubernetes 1.6.2. The ingress service has the `service.beta.kubernetes.io/external-traffic` annotation set to `OnlyLocal`.\r\n\r\nI have an ingress that looks like this:\r\n\r\n```yaml\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  annotations:\r\n    ingress.kubernetes.io/ssl-redirect: \"false\"\r\n    ingress.kubernetes.io/whitelist-source-range: 192.30.252.0/22,185.199.108.0/22\r\n  name: web-server\r\n  namespace: default\r\nspec:\r\n  rules:\r\n  - host: www.example.com\r\n    http:\r\n      paths:\r\n      - backend:\r\n          serviceName: web-server\r\n          servicePort: 80\r\n        path: /\r\n  tls:\r\n  - hosts:\r\n    - www.example.com\r\n```\r\n\r\n`curl https://www.example.com` (https) doesn't work no matter the source IP is in the white-listed range or not. (My IP is `1.2.3.4` here)\r\n\r\n```\r\nnginx-ingress-controller-31897685-5ljx5 nginx-ingress-lb 2017/05/17 15:35:15 [error] 227#227: *11 access forbidden by rule, client: 127.0.0.1, server: www.example.com, request: \"GET / HTTP/2.0\", host: \"www.example.com\"\r\nnginx-ingress-controller-31897685-5ljx5 nginx-ingress-lb 1.2.3.4 - [1.2.3.4] - - [17/May/2017:15:35:15 +0000] \"GET / HTTP/2.0\" 403 234 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.1.1 Safari/603.2.4\" 177 0.000 [web-server-80] - - - -\r\n```\r\n\r\nNote that the client IP address becomes the `127.0.0.1`, which is not expected.\r\n\r\n`curl http://www.example.com` (http) works as expected. If outside the white-listed range, nginx is able to identify the client IP address: \r\n\r\n```\r\nnginx-ingress-controller-31897685-5ljx5 nginx-ingress-lb 2017/05/17 15:38:23 [error] 306#306: *19 access forbidden by rule, client: 1.2.3.4, server: www.example.com, request: \"GET / HTTP/1.1\", host: \"www.example.com\"\r\nnginx-ingress-controller-31897685-5ljx5 nginx-ingress-lb 1.2.3.4 - [1.2.3.4] - - [17/May/2017:15:38:23 +0000] \"GET / HTTP/1.1\" 403 170 \"-\" \"curl/7.52.1\" 98 0.000 [web-server-80] - - - -\r\n```\r\n\r\nI am not sure why nginx is able to identify the correct client IP address in the request log, but it doesn’t use this client IP to determine if the request should be allowed. \r\n\r\nI think this is related to https://github.com/kubernetes/ingress/pull/614"},"comment":{"url":"https://api.github.com/repos/kubernetes/ingress/issues/comments/302907129","html_url":"https://github.com/kubernetes/ingress/issues/727#issuecomment-302907129","issue_url":"https://api.github.com/repos/kubernetes/ingress/issues/727","id":302907129,"user":{"login":"cheungpat","id":170071,"avatar_url":"https://avatars3.githubusercontent.com/u/170071?v=3","gravatar_id":"","url":"https://api.github.com/users/cheungpat","html_url":"https://github.com/cheungpat","followers_url":"https://api.github.com/users/cheungpat/followers","following_url":"https://api.github.com/users/cheungpat/following{/other_user}","gists_url":"https://api.github.com/users/cheungpat/gists{/gist_id}","starred_url":"https://api.github.com/users/cheungpat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cheungpat/subscriptions","organizations_url":"https://api.github.com/users/cheungpat/orgs","repos_url":"https://api.github.com/users/cheungpat/repos","events_url":"https://api.github.com/users/cheungpat/events{/privacy}","received_events_url":"https://api.github.com/users/cheungpat/received_events","type":"User","site_admin":false},"created_at":"2017-05-21T00:27:28Z","updated_at":"2017-05-21T00:27:28Z","body":"@aledbf It works!"}}
{"actor":{"display_login":"cheungpat"}}