nginx: Option to not use incoming X-Forwarded headers

[albertvaka]

I'm reopening #1309 as, if I understand correctly, it hasn't been fixed:

Currently, if you deploy nginx-ingress-controller facing directly to the internet (via NodePort/HostPort or a LoadBalancer service), end users can spoof their IP by sending an X-Forwarded-For header, which will be forwarded to the backend services. Same for the other X-Forwarded headers.

By looking at the template, there seems no config option to disable this.

It would be great to have one - in the current state the nginx ingress is insecure by default when exposing it directly to the internet.

[aledbf]

@albertvaka this is not correct. If you configure a cluster in AWS using a L7 ELB it works as expected
https://github.com/kubernetes/ingress-nginx/tree/master/deploy#aws

Edit: keep in mind you need to adjust the proxy-real-ip-cidr setting in the configuration configmap

[aledbf]

@albertvaka please post the steps you are following that reproduce the issue