<p>I've written a NGINX whitelister service inside my K8 cluster. Because everything entering the cluster goes through the load balancer, I had to whitelist the forwarded IP address instead of the source IP directly.</p>

<p>In testing, I hardcoded it like this in the NGINX config:</p>

<pre><code>set_real_ip_from x.x.x.x;
real_ip_header X-Forwarded-For;
</code></pre>

<p>Where <code>x.x.x.x</code> was the IP of the load balancer.</p>

<p>This worked.</p>

<p>I can't hardcode the IP in the actual deployment, so I was hoping to use the <code>kube-dns</code> service, like I used for the <code>proxy_pass</code>:</p>

<pre><code>resolver kube-dns.kube-system.svc.cluster.local;
proxy_pass http://{service}.{namespace}.svc.cluster.local:$server_port;
</code></pre>

<p>Which also works.</p>

<p>However, this DNS lookup doesn't seem to work for <code>set_real_ip_from</code>:</p>

<pre><code>resolver kube-dns.kube-system.svc.cluster.local;
set_real_ip_from {load balancer service}.kube-system.svc.cluster.local;
real_ip_header X-Forwarded-For;
</code></pre>

<p>When I run this, I just get <code>access forbidden by rule, client: x.x.x.x</code>(it's not in the whitelist), where <code>x.x.x.x</code> is the load balancer's IP. That kinda makes sense, since <code>set_real_ip_from</code> probably doesn't know to lookup the IP.</p>

<p><strong>Is it possible to have NGINX do a DNS lookup for the forwarder address?</strong> </p>

<p>If not, maybe someone has a better way to do this.</p>

<p>Thanks!</p>

Mitchell Turner
<p>I guess I just needed to sleep on this. Much simpler than I was making it. </p>

<p>I know the range that the load balancer should fall into, so I can just do a CIDR block for <code>set_real_ip_from</code>.</p>

<p>For example:</p>

<pre><code>set_real_ip_from 10.60.0.0/16;
real_ip_header X-Forwarded-For;
</code></pre>

<p>And there is no need for a DNS lookup.</p>
