Configure trusted forwarded header peers

[niemyjski]

Forwarded client IPs and schemes were accepted from any connecting peer. Trust only loopback and explicitly configured proxies/networks, validate settings at startup, and retain one-hop processing by default. The existing global-admin echo adds the effective scheme for rollout verification.

Hosted dev and prod explicitly configure the verified dedicated gateway subnet, 10.60.64.0/24, in their environment values. Update those values when the gateway network changes. The reusable chart defaults to no additional trusted networks and rejects conflicting forwarding overrides. There is no subnet discovery script, Azure discovery permission requirement, or per-deployment discovery step.

Migration: self-hosted installations with remote reverse proxies must configure trusted peers before upgrading. Invalid settings, /0 networks, and the root ForwardedHeaders_Enabled shortcut fail startup. Production Helm waits for readiness; it does not automatically roll back.

Validation: both environment Helm lint/render checks pass, including exact trust values, stale-list replacement, conflicting-override rejection, and empty reusable defaults. The explicit values match the earlier live gateway inspection; saved forwarding overrides were absent and the configured route is gateway → Service → application, with no extra proxy. All three CI-tooling tests pass. The unchanged application code previously passed the backend build and 60 focused forwarding, echo authorization, and OpenAPI checks. CI is rerunning for the cleanup.

Rollout: merge prerequisite #2673 first; this PR is temporarily based on that navigation-test fix. Merging this change into main automatically deploys dev. After deployment, follow the configuration, admin-echo baseline, spoof, and direct-untrusted-peer checks on both app/API hosts before production promotion. These runtime checks remain pending; no deployment was performed during verification.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d0f73af1c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b5091e48f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ejsmith]

Pre-merge verification results for fc93c8910:

• Fixed the discovery resource name to applicationloadbalancer.alb.networking.azure.io, matching the live cluster, and fixed Windows az.cmd invocation with validated, quoted arguments.
• Ran both commands from the PR checkout using Node 24.15.0:

node k8s/scripts/discover-forwarded-headers.js ex-dev k8s/ex-dev-values.yaml /tmp/dev-forwarding.json
node k8s/scripts/discover-forwarded-headers.js ex-prod k8s/ex-prod-values.yaml /tmp/prod-forwarding.json

Both exited 0, printed Discovered 1 gateway subnet prefix(es), and generated:

{"forwardedHeaders":{"knownNetworks":["10.60.64.0/24"]}}

• Subnet/readiness: both environments select kube-system/public-alb. Its Accepted=True and Deployment=True conditions match generation 1. Azure confirms association subnet ex-net-v6/ex-agc is 10.60.64.0/24, delegated to Microsoft.ServiceNetworking/trafficControllers.
• Configured proxy path: live app/API ingress backends point to their corresponding Services on port 80; EndpointSlices point to app/API pods on port 8080. The pods have no additional proxy containers. Runtime peer/IP/scheme checks still require the post-deployment echo tests.
• Existing configuration: helm get values succeeded for both releases. Neither has saved forwarding overrides. ForwardedHeaders_Enabled is absent from saved values, current ConfigMaps, and explicit app/API pod environment entries; no cleanup was needed.
• Generated configuration: both local Helm renders produce EX_ForwardedHeaders__Enabled=true, EX_ForwardedHeaders__ForwardLimit=1, and EX_ForwardedHeaders__KnownNetworks__0=10.60.64.0/24.
• Local validation: all five CI-tooling tests passed, including two new discovery regression scenarios; focused script lint, Node syntax checks, and diff checks passed. Hosted CI and automated review are still running at this head.

Remaining merge gate: these successful live runs used the existing authenticated Azure user identity, not the deployment service principal. They do not prove that the CI deployment identity has the required reads. Both commands still need successful execution with that identity before merge.

No merge, deployment, or cluster configuration mutation was performed. After dev deployment, the PR's admin-echo baseline, spoof, and authorized direct-backend checks remain required before production promotion.

[ejsmith]

Cleanup pushed at 9b8a9674f:

• Removed the gateway discovery script, its regression tests, the deploy-job Node setup, and both discovery invocations. Deployment uses the checked-in environment values.
• Dev and prod explicitly trust 10.60.64.0/24, matching the earlier live inspection of the dedicated gateway association subnet. The reusable chart keeps its trusted-network list empty. Update the environment values alongside a gateway network change.
• Kept the application trust validation, forwarding security tests, admin-echo diagnostics, self-hosted migration instructions, and post-deployment checks. Rewrote the PR description around this final scope.
• Extracted the navigation test fix to Wait for saved stack view navigation in the operator test #2673 and the Docker Node upgrade to Use Node 24 for Docker frontend builds #2674. Wait for saved stack view navigation in the operator test #2673 is now the prerequisite below this PR in the native stack; the existing Validate external account state and identity #2630/Protect user updates and clean up orphaned private views #2631 branch heads and bases are unchanged. Configure trusted forwarded header peers #2629's diff contains neither unrelated change.

Local cleanup verification passed: Helm lint/render for dev and prod, exact forwarding keys, replacement of stale subnet lists, rejection of conflicting overrides, empty reusable defaults, manual self-hosted proxy configuration, and all three CI-tooling tests. The explicit values equal both previously generated discovery files. Frontend validation, all 1,048 unit tests, and the production build also passed on Node 24 for the extracted changes. CI and automated review are running on the updated PRs.

This supersedes the discovery/service-principal permission gate in my earlier verification comment: deployment no longer performs those reads. The earlier Azure-user inspection established configuration/topology, not runtime header behavior. After dev deploys, the documented admin-echo baseline, spoof, and authorized direct-backend checks still must pass before production promotion. Nothing was merged or deployed during this cleanup.

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
Exceptionless.AppHost	23%	23%	128	❌
Exceptionless.Core	78%	69%	10924	✔
Exceptionless.Insulation	51%	43%	370	➖
Exceptionless.Web	86%	71%	9237	✔
Summary	80% (28337 / 35255)	69% (14028 / 20226)	20659	✔