support internal IP address range configuration for api-server

[arvados-k8s.git] / charts / arvados / templates / api-server-configmap.yaml

diff --git a/charts/arvados/templates/api-server-configmap.yaml b/charts/arvados/templates/api-server-configmap.yaml
index 2cea6dc37eb778eff682044f3f2f14a58a51a207..80e3f7e866860bcda1f77418b8b57f90449da290 100644 (file)
--- a/charts/arvados/templates/api-server-configmap.yaml
+++ b/charts/arvados/templates/api-server-configmap.yaml
@@ -29,6 +29,10 @@ data:
     upstream controller {
       server                127.0.0.1:9004;
     }
+    upstream rails {
+      server                127.0.0.1:8000;
+    }
+
 
     proxy_http_version 1.1;
 
@@ -39,7 +43,9 @@ data:
     # direct access to Keep storage daemons to set this header value to 0.
     geo $external_client {
       default     1;
-      10.0.0.0/8  0;
+      {{- range .Values.internalIPs }}
+      {{ . }} 0;
+      {{- end }}
     }
 
     server {
@@ -54,6 +60,17 @@ data:
       # Redirect plain HTTP requests to HTTPS.
       error_page 497 301 =307 https://$host:$server_port$request_uri;
 
+      location /rails/_health/ping {
+        proxy_pass            http://rails/_health/ping;
+        proxy_connect_timeout 90s;
+        proxy_read_timeout    300s;
+        proxy_redirect        off;
+        proxy_set_header      X-Forwarded-Proto https;
+        proxy_set_header      Host $http_host;
+        proxy_set_header      X-External-Client $external_client;
+        proxy_set_header      X-Real-IP $remote_addr;
+        proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
+      }
       location / {
         proxy_pass            http://controller;
         proxy_connect_timeout 90s;