breaking change: by default do not trust any client

[ElvinEfendi]

What this PR does / why we need it:

Currently we configure Nginx in a way that it trusts any client to extract true client IP address from X-Forwarded-For header using realip module. This PR makes it so that by default it does not trust any client at all.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #

Special notes for your reviewer:

[Dirbaio]

This change makes nginx-ingress not trust the IP for the X-Forwarded-For header, but the client can still spoof X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto, X-Scheme

The correct change to the defaults would be UseForwardedHeaders: False (and leave ProxyRealIPCIDR as is)

I 100% support setting UseForwardedHeaders: False by default. I was also accidentally vulnerable to IP spoofing due to this. nginx-ingress should be secure by default.

[ElvinEfendi]

but the client can still spoof X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto, X-Scheme

@Dirbaio is there any practical security implication with this?

I agree that modifying UseForwardedHeaders is better since not using them is a default Nginx behaviour.

[Dirbaio]

They're more rare, but there are indeed vulnerabilities that can be caused by the other X-Forwarded-* headers spoofing.

For example: Software often uses X-Forwarded-Host, X-Forwarded-Scheme to build "links to itself" to use in emails and such. If you can mess with these, you can make these links go somewhere else, which can be bad for password reset emails, for example.

Aside from vulns, disabling all X-Forwarded-* headers is the best option for consistency. It would be strange that only the IP one is disabled.

[aledbf]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, ElvinEfendi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ElvinEfendi,aledbf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment