绕过 nginx 入口 controller 速率限制

Question

I'm trying to enable some sort of rate limiting for a EKS cluster using nginx ingress controller where I also need to somehow whitelist a couple if IPs from this rate limit rule that are in charge of health and metrics checkups. If I use the annotations nginx.ingress.kubernetes.io/whitelist-source-range and nginx.ingress.kubernetes.io/limit-connections it just adds the limit to the whitelist IPs. Is there another way to setup this? Thank you!

Answer 1

The problem in fact that it ignores the whitelisting due to the lack of x-forwarded-for , but this activating this in production can be a security flaw, as discussed on: https://github.com/kubernetes/ingress-nginx/pull/2881