<p>I'm running into an issue with an nginx ingress controller (ingress-nginx v0.44.0) on EKS where the X-Forwarded-* headers are set to the kubernetes worker node the controller pod is running on as opposed to the details of the request of the actual user hitting the controller itself.
As we're terminating our SSL on the ingress controller this means the 'X-Forwarded-Proto' is set to 'http' instead of 'https' which causes issues on the application pods.</p>
<p>I deployed a <a href="https://github.com/brndnmtthws/nginx-echo-headers" rel="nofollow noreferrer">test pod</a> which returns the headers it received to confirm the issue and I can see these headers having been received:</p>
<pre><code>X-Forwarded-For: &lt;ip of the eks worker node&gt;
X-Forwarded-Host: foo.bar.net
X-Forwarded-Port: 8000
X-Forwarded-Proto: http
</code></pre>
<p>I was expecting these though:</p>
<pre><code>X-Forwarded-For: &lt;ip of the origin of the original request&gt;
X-Forwarded-Host: foo.bar.net
X-Forwarded-Port: 443
X-Forwarded-Proto: https
</code></pre>
<p>Now, we do have an old legacy cluster running an older nginx ingress controller (nginx-ingress v0.34.1) which does actually behave as I expected, but I'm struggling to find how this has been configured to make it do this correctly.
I did notice that the nginx.conf of this controller contains the 'full_x_forwarded_proto' variable identically as <a href="https://stackoverflow.com/questions/21230918/nginx-scheme-variable-behind-load-balancer/21911864#21911864">described here</a> but I can't find any place where this is configured as in a configmap or similar.</p>
<pre><code>map $http_x_forwarded_proto $full_x_forwarded_proto {
  default $http_x_forwarded_proto;
  &quot;&quot; $scheme;
}
</code></pre>
<p>Does anybody have any suggestions how I can configure nginx to send the correct 'X-Forwarded-*' headers?</p>

<p>It depends a lot on the exact networking setup in front of Nginx. By default, Kubernetes routes all external connections through the kube-proxy mesh which hides the true client IP. You also might have an AWS ELB of some kind in front of that which also can hide the client IP depending on settings.</p>
<p>For the first part, see <a href="https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-type-loadbalancer" rel="nofollow noreferrer">https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-type-loadbalancer</a> (tl;dr set <code>externalTrafficPolicy: Local</code>) but for the second you'll have to look at your specific load balancer setup.</p>
