Add proxy-set-headers annotation for ingress

internal/configs/annotations.go

@@ -213,6 +213,11 @@ func parseAnnotations(ingEx *IngressEx, baseCfgParams *ConfigParams, isPlus bool
 		cfgParams.ProxyPassHeaders = proxyPassHeaders
 	}
 
+	if proxySetHeaders, exists := GetMapKeyAsStringSlice(ingEx.Ingress.Annotations, "nginx.org/proxy-set-headers", ingEx.Ingress, ","); exists {
+		parsedHeaders := parseProxySetHeaders(proxySetHeaders)
+		cfgParams.ProxySetHeaders = parsedHeaders
+	}
+
 	if clientMaxBodySize, exists := ingEx.Ingress.Annotations["nginx.org/client-max-body-size"]; exists {
 		cfgParams.ClientMaxBodySize = clientMaxBodySize
 	}

internal/configs/config_params.go

@@ -1,6 +1,7 @@
 package configs
 
 import (
+	"github.com/nginxinc/kubernetes-ingress/internal/configs/version2"
 	"github.com/nginxinc/kubernetes-ingress/internal/nginx"
 	conf_v1 "github.com/nginxinc/kubernetes-ingress/pkg/apis/configuration/v1"
 )
@@ -70,6 +71,7 @@ type ConfigParams struct {
 	ProxyHideHeaders                       []string
 	ProxyMaxTempFileSize                   string
 	ProxyPassHeaders                       []string
+	ProxySetHeaders                        []version2.Header
 	ProxyProtocol                          bool
 	ProxyReadTimeout                       string
 	ProxySendTimeout                       string

internal/configs/configmaps.go

@@ -3,6 +3,8 @@ package configs
 import (
 	"strings"
 
+	"github.com/nginxinc/kubernetes-ingress/internal/configs/version2"
+
 	"github.com/golang/glog"
 	v1 "k8s.io/api/core/v1"
 
@@ -66,6 +68,20 @@ func ParseConfigMap(cfgm *v1.ConfigMap, nginxPlus bool, hasAppProtect bool, hasA
 		cfgParams.ProxyPassHeaders = proxyPassHeaders
 	}
 
+	if proxySetHeaders, exists := GetMapKeyAsStringSlice(cfgm.Data, "proxy-set-headers", cfgm, ","); exists {
+		var headers []version2.Header
+		for _, headerAndValue := range proxySetHeaders {
+			parts := strings.SplitN(headerAndValue, " ", 2)
+			name := strings.TrimSpace(parts[0])
+			var value string
+			if len(parts) > 1 {
+				value = strings.TrimSpace(parts[1])
+			}
+			headers = append(headers, version2.Header{Name: name, Value: value})
+		}
+		cfgParams.ProxySetHeaders = headers
+	}
+
 	if clientMaxBodySize, exists := cfgm.Data["client-max-body-size"]; exists {
 		cfgParams.ClientMaxBodySize = clientMaxBodySize
 	}

internal/configs/ingress.go

@@ -475,6 +475,7 @@ func createLocation(path string, upstream version1.Upstream, cfg *ConfigParams,
 		ProxyConnectTimeout:  cfg.ProxyConnectTimeout,
 		ProxyReadTimeout:     cfg.ProxyReadTimeout,
 		ProxySendTimeout:     cfg.ProxySendTimeout,
+		ProxySetHeaders:      cfg.ProxySetHeaders,
 		ClientMaxBodySize:    cfg.ClientMaxBodySize,
 		Websocket:            websocket,
 		Rewrite:              rewrite,

internal/configs/parsing_helpers.go

@@ -7,6 +7,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/nginxinc/kubernetes-ingress/internal/configs/version2"
+
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )
@@ -276,6 +278,20 @@ func ParseProxyBuffersSpec(s string) (string, error) {
 	return "", errors.New("invalid proxy buffers string")
 }
 
+// parseProxySetHeaders ensures that the string colon-separated list of headers and values
+func parseProxySetHeaders(proxySetHeaders []string) []version2.Header {
+	var headers []version2.Header
+	for _, header := range proxySetHeaders {
+		parts := strings.SplitN(header, ":", 2)
+		if len(parts) == 1 {
+			headers = append(headers, version2.Header{Name: parts[0], Value: ""})
+		} else {
+			headers = append(headers, version2.Header{Name: parts[0], Value: parts[1]})
+		}
+	}
+	return headers
+}
+
 // ParsePortList ensures that the string is a comma-separated list of port numbers
 func ParsePortList(s string) ([]int, error) {
 	var ports []int

internal/configs/version1/config.go

@@ -1,6 +1,9 @@
 package version1
 
-import "github.com/nginxinc/kubernetes-ingress/internal/nginx"
+import (
+	"github.com/nginxinc/kubernetes-ingress/internal/configs/version2"
+	"github.com/nginxinc/kubernetes-ingress/internal/nginx"
+)
 
 // UpstreamLabels describes the Prometheus labels for an NGINX upstream.
 type UpstreamLabels struct {
@@ -166,6 +169,7 @@ type Location struct {
 	ProxyConnectTimeout  string
 	ProxyReadTimeout     string
 	ProxySendTimeout     string
+	ProxySetHeaders      []version2.Header
 	ClientMaxBodySize    string
 	Websocket            bool
 	Rewrite              string

internal/configs/version1/nginx-plus.ingress.tmpl

@@ -260,9 +260,9 @@ server {
 		proxy_set_header Upgrade $http_upgrade;
 		proxy_set_header Connection $connection_upgrade;
 		{{- else}}
-		{{- if $.Keepalive}}proxy_set_header Connection "";{{end}}
+		{{- if $.Keepalive}}
+		proxy_set_header Connection "";{{end}}
 		{{- end}}
-
 		{{- if $location.LocationSnippets}}
 		{{range $value := $location.LocationSnippets}}
 		{{$value}}{{end}}
@@ -285,6 +285,8 @@ server {
 		proxy_read_timeout {{$location.ProxyReadTimeout}};
 		proxy_send_timeout {{$location.ProxySendTimeout}};
 		client_max_body_size {{$location.ClientMaxBodySize}};
+		{{- $proxySetHeaders := generateProxySetHeaders $location $.Ingress.Annotations }}
+		{{$proxySetHeaders}}
 		proxy_set_header Host $host;
 		proxy_set_header X-Real-IP $remote_addr;
 		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

internal/configs/version1/nginx.ingress.tmpl

@@ -180,23 +180,23 @@ server {
 		proxy_set_header Upgrade $http_upgrade;
 		proxy_set_header Connection $connection_upgrade;
 		{{- else}}
-		{{- if $.Keepalive}}proxy_set_header Connection "";{{end}}
+		{{- if $.Keepalive}}
+		proxy_set_header Connection "";{{end}}
 		{{- end}}
-
 		{{- if $location.LocationSnippets}}
 		{{range $value := $location.LocationSnippets}}
 		{{$value}}{{end}}
 		{{- end}}
-
 		{{- with $location.BasicAuth }}
 		auth_basic {{ printf "%q" .Realm }};
 		auth_basic_user_file {{ .Secret }};
 		{{- end }}
-
 		proxy_connect_timeout {{$location.ProxyConnectTimeout}};
 		proxy_read_timeout {{$location.ProxyReadTimeout}};
 		proxy_send_timeout {{$location.ProxySendTimeout}};
 		client_max_body_size {{$location.ClientMaxBodySize}};
+		{{- $proxySetHeaders := generateProxySetHeaders $location $.Ingress.Annotations -}}
+		{{$proxySetHeaders}}
 		proxy_set_header Host $host;
 		proxy_set_header X-Real-IP $remote_addr;
 		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

internal/configs/version1/template_helper.go

@@ -1,7 +1,9 @@
 package version1
 
 import (
+	"errors"
 	"fmt"
+	"regexp"
 	"strings"
 	"text/template"
 
@@ -64,14 +66,131 @@ func makePathWithRegex(path, regexType string) string {
 	}
 }
 
+var setHeader = regexp.MustCompile("^[-A-Za-z0-9]+$")
+
+func validateProxySetHeader(header string) error {
+	header = strings.TrimSpace(header)
+	if !setHeader.MatchString(header) {
+		return errors.New("invalid header syntax - syntax must be header: value")
+	}
+	return nil
+}
+
+func defaultHeaderValues(headerParts []string, headerName string) string {
+	headerValue := strings.TrimSpace(headerParts[0])
+	headerValue = strings.ReplaceAll(headerValue, "-", "_")
+	headerValue = strings.ToLower(headerValue)
+	return fmt.Sprintf("\n\t\tproxy_set_header %s $http_%s;", headerName, headerValue)
+}
+
+func headersGreaterThanOne(headerParts []string, headerName string) string {
+	headerValue := strings.TrimSpace(headerParts[1])
+	return fmt.Sprintf("\n\t\tproxy_set_header %s %q;", headerName, headerValue)
+}
+
+func splitHeaders(header string) ([]string, string) {
+	header = strings.TrimSpace(header)
+	headerParts := strings.SplitN(header, ":", 2)
+	headerName := strings.TrimSpace(headerParts[0])
+	return headerParts, headerName
+}
+
+// minionProxySetHeaders takes a location and a bool map
+// and generates proxy_set_header headers for minions based on the nginx.org/proxy-set-headers annotation in a mergeable ingress.
+// It returns a string containing the generated proxy headers and a map to verify that the header exists
+func minionProxySetHeaders(loc *Location, minionHeaders map[string]bool) (string, map[string]bool, error) {
+	proxySetHeaders, ok := loc.MinionIngress.Annotations["nginx.org/proxy-set-headers"]
+	if !ok {
+		return "", nil, nil
+	}
+	var combinedMinions string
+	headers := strings.Split(proxySetHeaders, ",")
+	for _, header := range headers {
+		headerParts, headerName := splitHeaders(header)
+		err := validateProxySetHeader(headerName)
+		if err != nil {
+			return "", nil, err
+		}
+		if len(headerParts) > 1 {
+			output := headersGreaterThanOne(headerParts, headerName)
+			minionHeaders[headerName] = true
+			combinedMinions += output
+		} else {
+			output := defaultHeaderValues(headerParts, headerName)
+			combinedMinions += output
+		}
+	}
+	return combinedMinions, minionHeaders, nil
+}
+
+// standardIngressOrMasterProxySetHeaders takes two strings, two bools and a bool map
+// and generates proxy_set_header headers based on the nginx.org/proxy-set-headers annotation in a standard ingress.
+// It returns a string containing the generated proxy headers for either standardIngress/NonMergeable or Master.
+func standardIngressOrMasterProxySetHeaders(result string, minionHeaders map[string]bool, proxySetHeaders string, ok bool, isMergeable bool) (string, error) {
+	if !ok {
+		return "", nil
+	}
+	headers := strings.Split(proxySetHeaders, ",")
+	for _, header := range headers {
+		headerParts, headerName := splitHeaders(header)
+		if isMergeable {
+			if _, ok := minionHeaders[headerName]; ok {
+				continue
+			}
+		}
+		if err := validateProxySetHeader(headerName); err != nil {
+			return "", err
+		}
+		if len(headerParts) > 1 {
+			output := headersGreaterThanOne(headerParts, headerName)
+			result += output
+		} else {
+			output := defaultHeaderValues(headerParts, headerName)
+			result += output
+		}
+	}
+	return result, nil
+}
+
+// generateProxySetHeaders takes a location and an ingress annotations map
+// and generates proxy_set_header directives based on the nginx.org/proxy-set-headers annotation.
+// It returns a string containing the generated Nginx configuration to the template.
+func generateProxySetHeaders(loc *Location, ingressAnnotations map[string]string) (string, error) {
+	proxySetHeaders, ok := ingressAnnotations["nginx.org/proxy-set-headers"]
+	var ingressResult string
+	minionHeaders := make(map[string]bool)
+	isMergeable := loc.MinionIngress != nil
+	if !isMergeable {
+		ingressResult, err := standardIngressOrMasterProxySetHeaders(ingressResult, minionHeaders, proxySetHeaders, ok, isMergeable)
+		if err != nil {
+			return "", err
+		}
+		return ingressResult, nil
+	}
+	combinedHeaders, minionHeaders, err := minionProxySetHeaders(loc, minionHeaders)
+	if err != nil {
+		return "", err
+	}
+	proxySetHeaders, ok = ingressAnnotations["nginx.org/proxy-set-headers"]
+	if !ok {
+		return combinedHeaders, nil
+	}
+	combinedHeaders, err = standardIngressOrMasterProxySetHeaders(combinedHeaders, minionHeaders, proxySetHeaders, ok, isMergeable)
+	if err != nil {
+		return "", err
+	}
+	return combinedHeaders, nil
+}
+
 var helperFunctions = template.FuncMap{
-	"split":            split,
-	"trim":             trim,
-	"contains":         strings.Contains,
-	"hasPrefix":        strings.HasPrefix,
-	"hasSuffix":        strings.HasSuffix,
-	"toLower":          strings.ToLower,
-	"toUpper":          strings.ToUpper,
-	"makeLocationPath": makeLocationPath,
-	"makeSecretPath":   commonhelpers.MakeSecretPath,
+	"split":                   split,
+	"trim":                    trim,
+	"contains":                strings.Contains,
+	"hasPrefix":               strings.HasPrefix,
+	"hasSuffix":               strings.HasSuffix,
+	"toLower":                 strings.ToLower,
+	"toUpper":                 strings.ToUpper,
+	"makeLocationPath":        makeLocationPath,
+	"makeSecretPath":          commonhelpers.MakeSecretPath,
+	"generateProxySetHeaders": generateProxySetHeaders,
 }