feat: add configurable real_ip_header option for nginx

[vichaos]

Add configurable real_ip_header option for nginx configuration

Summary

This PR makes the nginx real_ip_header directive configurable via values.yaml, allowing users to customize which header is used to extract the real client IP address.

Changes

• Added apisix.nginx.realIpHeader configuration option in values.yaml with a default value of "X-Real-IP"
• Updated configmap.yaml template to use the configurable value instead of hardcoded "X-Real-IP"
• Maintains backward compatibility with existing deployments (default remains "X-Real-IP")

Why This Change is Necessary

Different deployment environments and proxy setups use different headers to pass the original client IP address:

1. Load Balancer Variations: Different cloud providers and load balancers use different headers:

   • AWS ALB/ELB often uses X-Forwarded-For
   • Cloudflare uses CF-Connecting-IP
   • Google Cloud Load Balancer may use X-Forwarded-For
   • Some proxies use X-Real-IP (current default)

2. Multi-Layer Proxy Environments: In complex deployments with multiple proxy layers (e.g., CDN → Load Balancer → Ingress → APISIX), the appropriate header may differ based on architecture.

3. Security and Rate Limiting: Correctly identifying client IPs is crucial for:

   • Accurate rate limiting based on client IP
   • Security plugins that rely on IP-based access control
   • Logging and analytics
   • Compliance requirements

4. Flexibility: Without this configuration option, users would need to either:

   • Fork the chart and modify it
   • Use post-deployment patches
   • Accept incorrect IP detection in their environment

This change provides the flexibility needed for various deployment scenarios while maintaining sensible defaults.

Usage Example

apisix:
  nginx:
    realIpHeader: "X-Forwarded-For"  # For AWS ALB/ELB environments

Or via Helm CLI:

helm install apisix . --set apisix.nginx.realIpHeader="CF-Connecting-IP"

[ngclinflows]

Hi @vichaos,

I think you missed to add a chart value for the complementary apisix.nginx_config.http.real_ip_from APISIX config parameter: it allows to trust a set of IPs and/or CIDRs and then effectively replace properly client address in $remote_addr with the one provided in the X-Real-IP/X-Forwarded-For/Forwarded header

[ngclinflows]

Don't forget to run the make helm-docs command to update the documentation.

[vichaos]

@ngclinflows Thanks for raising this. I’ve added support for the complementary apisix.nginx_config.http.real_ip_from parameter in the chart values so APISIX can properly trust the defined IPs/CIDRs for client address handling.
Feel free to review the update and let me know if I should refine anything further.

[ngclinflows]

Seems good to me 👍