title: Nginx real_ip_header through a GCE ingress?
body: <p>My goal is to filter access by IP address of an angular app deployed on Kubernetes Engine served by nginx through a GCE ingress.</p>
  
  <p>But on my nginx the remote_addr is not right.</p>
  
  <p><strong>$LB_IP is the ip defined here :     kubernetes.io/ingress.global-static-ip-name: app-angular</strong></p>
  
  <p>I'm using set_real_ip_from on nginx to set the ip from X-Forwarded-For     </p>
  
  <pre><code>set_real_ip_from $LB_IP;
  real_ip_header X-Forwarded-For;
  </code></pre>
  
  <p>The original ip comes in the X-Forwarded-For header as expected from the google doc : <a href="https://cloud.google.com/compute/docs/load-balancing/http/#components" rel="nofollow noreferrer">https://cloud.google.com/compute/docs/load-balancing/http/#components</a></p>
  
  <p>I can see the X-Forwarded-For contains the $CLIENT_IP but the remote_addr is not correct, and by the way my filter on IP is not working. Any idea ?</p>
  
  <p>My nginx logs :</p>
  
  <blockquote>
    <p>10.40.40.40 - - [07/Feb/2018:11:29:48 +0000] "GET /styles.bundle.css HTTP/1.1" 200 35908 "<a href="http://MY_URL/home" rel="nofollow noreferrer">http://MY_URL/home</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36" "$CLIENT_IP, $LB_IP"</p>
  </blockquote>
  
  <p>But i want : </p>
  
  <blockquote>
    <p>$CLIENT_IP - - [07/Feb/2018:11:29:48 +0000] "GET /styles.bundle.css HTTP/1.1" 200 35908 "<a href="http://MY_URL/home" rel="nofollow noreferrer">http://MY_URL/home</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36" "$CLIENT_IP, $LB_IP"</p>
  </blockquote>
  
  <p><strong>My Ingress configuration :</strong></p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: ingress
    annotations:
      kubernetes.io/ingress.global-static-ip-name: app-angular
  spec:
    rules:
      - host: MY_URL
        http:
          paths:
          - backend:
              serviceName: app-backend
              servicePort: 80
  </code></pre>
  
  <p><strong>My backend configuration :</strong></p>
  
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: app-backend
  spec:
    type: NodePort
    selector:
      app: app-angular
    ports:
    - port: 80
      targetPort: 80
  </code></pre>
  
  <p><strong>My deployment configuration :</strong></p>
  
  <pre><code>apiVersion: apps/v1beta1
  kind: Deployment
  metadata:
    name: app-angular
  spec:
    replicas: 2
    revisionHistoryLimit: 2
    template:
      metadata:
        labels:
          app: app-angular
          tier: frontend
      spec:
        containers:
        - name: app-angular
          image: gcr.io/MY_PROJECT/app-angular:MY_TAG
          imagePullPolicy: Always
          ports:
            - containerPort: 80
  </code></pre>
  
  <p><strong>My nginx configuration :</strong></p>
  
  <pre><code>server {
    listen 80;
  
    root /usr/share/nginx/html;
  
    location / {
  
      set_real_ip_from $LB_IP;
      real_ip_header X-Forwarded-For;
  
      allow 130.211.0.0/22; #Google IP
      allow $CLIENT_IP; # FILTERED IP
      allow 10.0.0.0/8; #internal network
      deny all;
  
      index index.html index.htm;
      try_files $uri $uri/ /index.html =404;
    }
  
  }
  </code></pre>
  
  <p>Any idea ?</p>