Repository: kubernetes/ingress-nginx
Pull request #4569 (2019-09-17 09:40:22)

allow to configure jaeger header names
<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://git.k8s.io/community/contributors/guide/pull-requests.md#the-pull-request-submit-process and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
2. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
-->

**What this PR does / why we need it**:

This PR allows to configure jaeger header names as mentioned in [https://github.com/opentracing-contrib/nginx-opentracing#getting-started](url)





Patch:
diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md
index c240a114c..693025999 100755
--- a/docs/user-guide/nginx-configuration/annotations.md
+++ b/docs/user-guide/nginx-configuration/annotations.md
@@ -19,7 +19,6 @@ You can add these Kubernetes annotations to specific Ingress objects to customiz
 |[nginx.ingress.kubernetes.io/affinity](#session-affinity)|cookie|
 |[nginx.ingress.kubernetes.io/auth-realm](#authentication)|string|
 |[nginx.ingress.kubernetes.io/auth-secret](#authentication)|string|
-|[nginx.ingress.kubernetes.io/auth-secret-type](#authentication)|string|
 |[nginx.ingress.kubernetes.io/auth-type](#authentication)|basic or digest|
 |[nginx.ingress.kubernetes.io/auth-tls-secret](#client-certificate-authentication)|string|
 |[nginx.ingress.kubernetes.io/auth-tls-verify-depth](#client-certificate-authentication)|number|
@@ -167,7 +166,7 @@ The NGINX annotation `nginx.ingress.kubernetes.io/session-cookie-path` defines t
 
 ### Authentication
 
-Is possible to add authentication adding additional annotations in the Ingress rule. The source of the authentication is a secret that contains usernames and passwords.
+Is possible to add authentication adding additional annotations in the Ingress rule. The source of the authentication is a secret that contains usernames and passwords inside the key `auth`.
 
 The annotations are:
 ```
@@ -183,15 +182,6 @@ nginx.ingress.kubernetes.io/auth-secret: secretName
 The name of the Secret that contains the usernames and passwords which are granted access to the `path`s defined in the Ingress rules.
 This annotation also accepts the alternative form "namespace/secretName", in which case the Secret lookup is performed in the referenced namespace instead of the Ingress namespace.
 
-```
-nginx.ingress.kubernetes.io/auth-secret-type: [auth-file|auth-map]
-```
-
-The `auth-secret` can have two forms:
-
-- `auth-file` - default, an htpasswd file in the key `auth` within the secret
-- `auth-map` - the keys of the secret are the usernames, and the values are the hashed passwords
-
 ```
 nginx.ingress.kubernetes.io/auth-realm: "realm string"
 ```
diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md
index a5a697b2e..41aee95a1 100755
--- a/docs/user-guide/nginx-configuration/configmap.md
+++ b/docs/user-guide/nginx-configuration/configmap.md
@@ -58,7 +58,7 @@ The following table shows a configuration option's name, type, and the default v
 |[keep-alive-requests](#keep-alive-requests)|int|100|
 |[large-client-header-buffers](#large-client-header-buffers)|string|"4 8k"|
 |[log-format-escape-json](#log-format-escape-json)|bool|"false"|
-|[log-format-upstream](#log-format-upstream)|string|`$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`|
+|[log-format-upstream](#log-format-upstream)|string|`%v - [$the_real_ip] - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`|
 |[log-format-stream](#log-format-stream)|string|`[$time_local] $protocol $status $bytes_sent $bytes_received $session_time`|
 |[enable-multi-accept](#enable-multi-accept)|bool|"true"|
 |[max-worker-connections](#max-worker-connections)|int|16384|
@@ -125,6 +125,10 @@ The following table shows a configuration option's name, type, and the default v
 |[jaeger-sampler-param](#jaeger-sampler-param)|string|"1"|
 |[jaeger-sampler-host](#jaeger-sampler-host)|string|"http://127.0.0.1"|
 |[jaeger-sampler-port](#jaeger-sampler-port)|int|5778|
+|[jaeger-trace-context-header-name](#jaeger-trace-context-header-name)|string|uber-trace-id|
+|[jaeger-debug-header](#jaeger-debug-header)|string|uber-debug-id|
+|[jaeger-baggage-header](#jaeger-baggage-header)|string|jaeger-baggage|
+|[jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix)|string|uberctx-|
 |[main-snippet](#main-snippet)|string|""|
 |[http-snippet](#http-snippet)|string|""|
 |[server-snippet](#server-snippet)|string|""|
@@ -747,6 +751,22 @@ Leave blank to use default value (localhost). _**default:**_ http://127.0.0.1
 
 Specifies the custom remote sampler port to be passed to the sampler constructor. Must be a number. _**default:**_ 5778
 
+## jaeger-trace-context-header-name
+
+Specifies the header name used for passing trace context. _**default:**_ uber-trace-id
+
+## jaeger-debug-header
+
+Specifies the header name used for force sampling. _**default:**_ jaeger-debug-id
+
+## jaeger-baggage-header
+
+Specifies the header name used to submit baggage if there is no root span. _**default:**_ jaeger-baggage
+
+## jaeger-tracer-baggage-header-prefix
+
+Specifies the header prefix used to propagate baggage. _**default:**_ uberctx-
+
 ## main-snippet
 
 Adds custom configuration to the main section of the nginx configuration.
diff --git a/docs/user-guide/nginx-configuration/log-format.md b/docs/user-guide/nginx-configuration/log-format.md
index e39c5f695..700714349 100644
--- a/docs/user-guide/nginx-configuration/log-format.md
+++ b/docs/user-guide/nginx-configuration/log-format.md
@@ -4,7 +4,8 @@ The default configuration uses a custom logging format to add additional informa
 
 ```
 log_format upstreaminfo
-    '$remote_addr - $remote_user [$time_local] "$request" '
+    '{{ if $cfg.useProxyProtocol }}$proxy_protocol_addr{{ else }}$remote_addr{{ end }} - '
+    '[$the_real_ip] - $remote_user [$time_local] "$request" '
     '$status $body_bytes_sent "$http_referer" "$http_user_agent" '
     '$request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr '
     '$upstream_response_length $upstream_response_time $upstream_status $req_id';
@@ -13,7 +14,8 @@ log_format upstreaminfo
 | Placeholder | Description |
 |-------------|-------------|
 | `$proxy_protocol_addr` | remote address if proxy protocol is enabled |
-| `$remote_addr` | the source IP address of the client |
+| `$remote_addr` | remote address if proxy protocol is disabled (default) |
+| `$the_real_ip` | the source IP address of the client |
 | `$remote_user` | user name supplied with the Basic authentication |
 | `$time_local` | local time in the Common Log Format |
 | `$request` | full original request line |
diff --git a/docs/user-guide/third-party-addons/opentracing.md b/docs/user-guide/third-party-addons/opentracing.md
index 18b41b00c..a5bbd49ea 100644
--- a/docs/user-guide/third-party-addons/opentracing.md
+++ b/docs/user-guide/third-party-addons/opentracing.md
@@ -59,6 +59,18 @@ jaeger-sampler-host
 # Specifies the custom remote sampler port to be passed to the sampler constructor. Must be a number. Default: 5778
 jaeger-sampler-port
 
+# Specifies the header name used for passing trace context. Must be a string. Default: uber-trace-id
+jaeger-trace-context-header-name
+
+# Specifies the header name used for force sampling. Must be a string. Default: jaeger-debug-id
+jaeger-debug-header
+
+# Specifies the header name used to submit baggage if there is no root span. Must be a string. Default: jaeger-baggage
+jaeger-baggage-header
+
+# Specifies the header prefix used to propagate baggage. Must be a string. Default: uberctx-
+jaeger-tracer-baggage-header-prefix
+
 # specifies the port to use when uploading traces, Default 8126
 datadog-collector-port
 
diff --git a/internal/ingress/annotations/auth/main.go b/internal/ingress/annotations/auth/main.go
index 7326e4473..32a9c901f 100644
--- a/internal/ingress/annotations/auth/main.go
+++ b/internal/ingress/annotations/auth/main.go
@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"io/ioutil"
 	"regexp"
-	"strings"
 
 	"github.com/pkg/errors"
 	api "k8s.io/api/core/v1"
@@ -42,13 +41,12 @@ var (
 
 // Config returns authentication configuration for an Ingress rule
 type Config struct {
-	Type       string `json:"type"`
-	Realm      string `json:"realm"`
-	File       string `json:"file"`
-	Secured    bool   `json:"secured"`
-	FileSHA    string `json:"fileSha"`
-	Secret     string `json:"secret"`
-	SecretType string `json:"secretType"`
+	Type    string `json:"type"`
+	Realm   string `json:"realm"`
+	File    string `json:"file"`
+	Secured bool   `json:"secured"`
+	FileSHA string `json:"fileSha"`
+	Secret  string `json:"secret"`
 }
 
 // Equal tests for equality between two Config types
@@ -104,12 +102,6 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) {
 		return nil, ing_errors.NewLocationDenied("invalid authentication type")
 	}
 
-	var secretType string
-	secretType, err = parser.GetStringAnnotation("auth-secret-type", ing)
-	if err != nil {
-		secretType = "auth-file"
-	}
-
 	s, err := parser.GetStringAnnotation("auth-secret", ing)
 	if err != nil {
 		return nil, ing_errors.LocationDenied{
@@ -139,37 +131,24 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) {
 	realm, _ := parser.GetStringAnnotation("auth-realm", ing)
 
 	passFile := fmt.Sprintf("%v/%v-%v.passwd", a.authDirectory, ing.GetNamespace(), ing.GetName())
-
-	if secretType == "auth-file" {
-		err = dumpSecretAuthFile(passFile, secret)
-		if err != nil {
-			return nil, err
-		}
-	} else if secretType == "auth-map" {
-		err = dumpSecretAuthMap(passFile, secret)
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		return nil, ing_errors.LocationDenied{
-			Reason: errors.Wrap(err, "invalid auth-secret-type in annotation, must be 'auth-file' or 'auth-map'"),
-		}
+	err = dumpSecret(passFile, secret)
+	if err != nil {
+		return nil, err
 	}
 
 	return &Config{
-		Type:       at,
-		Realm:      realm,
-		File:       passFile,
-		Secured:    true,
-		FileSHA:    file.SHA1(passFile),
-		Secret:     name,
-		SecretType: secretType,
+		Type:    at,
+		Realm:   realm,
+		File:    passFile,
+		Secured: true,
+		FileSHA: file.SHA1(passFile),
+		Secret:  name,
 	}, nil
 }
 
 // dumpSecret dumps the content of a secret into a file
 // in the expected format for the specified authorization
-func dumpSecretAuthFile(filename string, secret *api.Secret) error {
+func dumpSecret(filename string, secret *api.Secret) error {
 	val, ok := secret.Data["auth"]
 	if !ok {
 		return ing_errors.LocationDenied{
@@ -186,22 +165,3 @@ func dumpSecretAuthFile(filename string, secret *api.Secret) error {
 
 	return nil
 }
-
-func dumpSecretAuthMap(filename string, secret *api.Secret) error {
-	builder := &strings.Builder{}
-	for user, pass := range secret.Data {
-		builder.WriteString(user)
-		builder.WriteString(":")
-		builder.WriteString(string(pass))
-		builder.WriteString("\n")
-	}
-
-	err := ioutil.WriteFile(filename, []byte(builder.String()), file.ReadWriteByUser)
-	if err != nil {
-		return ing_errors.LocationDenied{
-			Reason: errors.Wrap(err, "unexpected error creating password file"),
-		}
-	}
-
-	return nil
-}
diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go
index 35632a780..6950bab9c 100644
--- a/internal/ingress/controller/config/config.go
+++ b/internal/ingress/controller/config/config.go
@@ -55,7 +55,7 @@ const (
 
 	brotliTypes = "application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"
 
-	logFormatUpstream = `$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`
+	logFormatUpstream = `%v - [$the_real_ip] - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`
 
 	logFormatStream = `[$time_local] $protocol $status $bytes_sent $bytes_received $session_time`
 
@@ -515,6 +515,22 @@ type Configuration struct {
 	// Default: 5778
 	JaegerSamplerPort int `json:"jaeger-sampler-port"`
 
+	// JaegerTraceContextHeaderName specifies the header name used for passing trace context
+	// Default: uber-trace-id
+	JaegerTraceContextHeaderName string `json:"jaeger-trace-context-header-name"`
+
+	// JaegerDebugHeader specifies the header name used for force sampling
+	// Default: jaeger-debug-id
+	JaegerDebugHeader string `json:"jaeger-debug-header"`
+
+	// JaegerBaggageHeader specifies the header name used to submit baggage if there is no root span
+	// Default: jaeger-baggage
+	JaegerBaggageHeader string `json:"jaeger-baggage-header"`
+
+	// TraceBaggageHeaderPrefix specifies the header prefix used to propagate baggage
+	// Default: uberctx-
+	JaegerTraceBaggageHeaderPrefix string `json:"jaeger-tracer-baggage-header-prefix"`
+
 	// DatadogCollectorHost specifies the datadog agent host to use when uploading traces
 	DatadogCollectorHost string `json:"datadog-collector-host"`
 
@@ -768,7 +784,7 @@ func NewDefault() Configuration {
 // is enabled.
 func (cfg Configuration) BuildLogFormatUpstream() string {
 	if cfg.LogFormatUpstream == logFormatUpstream {
-		return fmt.Sprintf(cfg.LogFormatUpstream, "$remote_addr")
+		return fmt.Sprintf(cfg.LogFormatUpstream, "$the_real_ip")
 	}
 
 	return cfg.LogFormatUpstream
diff --git a/internal/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go
index 5a1317535..fd4bc78a8 100644
--- a/internal/ingress/controller/nginx.go
+++ b/internal/ingress/controller/nginx.go
@@ -1067,7 +1067,13 @@ const jaegerTmpl = `{
   },
   "reporter": {
 	"localAgentHostPort": "{{ .JaegerCollectorHost }}:{{ .JaegerCollectorPort }}"
-  }
+  },
+  "headers": {
+	"TraceContextHeaderName": "{{ .JaegerTraceContextHeaderName }}",
+	"jaegerDebugHeader": "{{ .JaegerDebugHeader }}",
+	"jaegerBaggageHeader": "{{ .JaegerBaggageHeader }}",
+	"traceBaggageHeaderPrefix": "{{ .JaegerTraceBaggageHeaderPrefix }}"
+  },
 }`
 
 const datadogTmpl = `{
diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl
index 0dd97b75a..a3e968d16 100755
--- a/rootfs/etc/nginx/template/nginx.tmpl
+++ b/rootfs/etc/nginx/template/nginx.tmpl
@@ -162,20 +162,20 @@ http {
     # https://github.com/leev/ngx_http_geoip2_module#example-usage
 
     geoip2 /etc/nginx/geoip/GeoLite2-City.mmdb {
-        $geoip2_city_country_code source=$remote_addr country iso_code;
-        $geoip2_city_country_name source=$remote_addr country names en;
-        $geoip2_city source=$remote_addr city names en;
-        $geoip2_postal_code source=$remote_addr postal code;
-        $geoip2_dma_code source=$remote_addr location metro_code;
-        $geoip2_latitude source=$remote_addr location latitude;
-        $geoip2_longitude source=$remote_addr location longitude;
-        $geoip2_time_zone source=$remote_addr location time_zone;
-        $geoip2_region_code source=$remote_addr subdivisions 0 iso_code;
-        $geoip2_region_name source=$remote_addr subdivisions 0 names en;
+        $geoip2_city_country_code source=$the_real_ip country iso_code;
+        $geoip2_city_country_name source=$the_real_ip country names en;
+        $geoip2_city source=$the_real_ip city names en;
+        $geoip2_postal_code source=$the_real_ip postal code;
+        $geoip2_dma_code source=$the_real_ip location metro_code;
+        $geoip2_latitude source=$the_real_ip location latitude;
+        $geoip2_longitude source=$the_real_ip location longitude;
+        $geoip2_time_zone source=$the_real_ip location time_zone;
+        $geoip2_region_code source=$the_real_ip subdivisions 0 iso_code;
+        $geoip2_region_name source=$the_real_ip subdivisions 0 names en;
     }
 
     geoip2 /etc/nginx/geoip/GeoLite2-ASN.mmdb {
-        $geoip2_asn source=$remote_addr autonomous_system_number;
+        $geoip2_asn source=$the_real_ip autonomous_system_number;
     }
     {{ end }}
 
@@ -306,6 +306,17 @@ http {
         {{ end }}
     }
 
+    # The following is a sneaky way to do "set $the_real_ip $remote_addr"
+    # Needed because using set is not allowed outside server blocks.
+    map '' $the_real_ip {
+    {{ if $cfg.UseProxyProtocol }}
+        # Get IP address from Proxy Protocol
+        default          $proxy_protocol_addr;
+    {{ else }}
+        default          $remote_addr;
+    {{ end }}
+    }
+
     # Reverse proxies can detect if a client provides a X-Request-ID header, and pass it on to the backend server.
     # If no such header is provided, it can provide a random value.
     map $http_x_request_id $req_id {
@@ -424,7 +435,7 @@ http {
 
     {{ range $rl := (filterRateLimits $servers ) }}
     # Ratelimit {{ $rl.Name }}
-    geo $remote_addr $whitelist_{{ $rl.ID }} {
+    geo $the_real_ip $whitelist_{{ $rl.ID }} {
         default 0;
         {{ range $ip := $rl.Whitelist }}
         {{ $ip }} 1;{{ end }}
@@ -893,11 +904,11 @@ stream {
             proxy_set_header            X-Original-URL          $scheme://$http_host$request_uri;
             proxy_set_header            X-Original-Method       $request_method;
             proxy_set_header            X-Sent-From             "nginx-ingress-controller";
-            proxy_set_header            X-Real-IP               $remote_addr;
+            proxy_set_header            X-Real-IP               $the_real_ip;
             {{ if and $all.Cfg.UseForwardedHeaders $all.Cfg.ComputeFullForwardedFor }}
             proxy_set_header            X-Forwarded-For        $full_x_forwarded_for;
             {{ else }}
-            proxy_set_header            X-Forwarded-For        $remote_addr;
+            proxy_set_header            X-Forwarded-For        $the_real_ip;
             {{ end }}
 
             {{ if $externalAuth.RequestRedirect }}
@@ -1185,11 +1196,11 @@ stream {
             {{ end }}
 
             {{ $proxySetHeader }} X-Request-ID           $req_id;
-            {{ $proxySetHeader }} X-Real-IP              $remote_addr;
+            {{ $proxySetHeader }} X-Real-IP              $the_real_ip;
             {{ if and $all.Cfg.UseForwardedHeaders $all.Cfg.ComputeFullForwardedFor }}
             {{ $proxySetHeader }} X-Forwarded-For        $full_x_forwarded_for;
             {{ else }}
-            {{ $proxySetHeader }} X-Forwarded-For        $remote_addr;
+            {{ $proxySetHeader }} X-Forwarded-For        $the_real_ip;
             {{ end }}
             {{ $proxySetHeader }} X-Forwarded-Host       $best_http_host;
             {{ $proxySetHeader }} X-Forwarded-Port       $pass_port;


Test patch:
diff --git a/internal/ingress/annotations/auth/main_test.go b/internal/ingress/annotations/auth/main_test.go
index 4fbb9d29c..b8e4d231c 100644
--- a/internal/ingress/annotations/auth/main_test.go
+++ b/internal/ingress/annotations/auth/main_test.go
@@ -182,25 +182,6 @@ func TestIngressAuthWithoutSecret(t *testing.T) {
 	}
 }
 
-func TestIngressAuthInvalidSecretKey(t *testing.T) {
-	ing := buildIngress()
-
-	data := map[string]string{}
-	data[parser.GetAnnotationWithPrefix("auth-type")] = "basic"
-	data[parser.GetAnnotationWithPrefix("auth-secret")] = "demo-secret"
-	data[parser.GetAnnotationWithPrefix("auth-secret-type")] = "invalid-type"
-	data[parser.GetAnnotationWithPrefix("auth-realm")] = "-realm-"
-	ing.SetAnnotations(data)
-
-	_, dir, _ := dummySecretContent(t)
-	defer os.RemoveAll(dir)
-
-	_, err := NewParser(dir, mockSecret{}).Parse(ing)
-	if err == nil {
-		t.Errorf("expected an error with invalid secret name")
-	}
-}
-
 func dummySecretContent(t *testing.T) (string, string, *api.Secret) {
 	dir, err := ioutil.TempDir("", fmt.Sprintf("%v", time.Now().Unix()))
 	if err != nil {
@@ -216,30 +197,20 @@ func dummySecretContent(t *testing.T) (string, string, *api.Secret) {
 	return tmpfile.Name(), dir, s
 }
 
-func TestDumpSecretAuthFile(t *testing.T) {
+func TestDumpSecret(t *testing.T) {
 	tmpfile, dir, s := dummySecretContent(t)
 	defer os.RemoveAll(dir)
 
 	sd := s.Data
 	s.Data = nil
 
-	err := dumpSecretAuthFile(tmpfile, s)
+	err := dumpSecret(tmpfile, s)
 	if err == nil {
 		t.Errorf("Expected error with secret without auth")
 	}
 
 	s.Data = sd
-	err = dumpSecretAuthFile(tmpfile, s)
-	if err != nil {
-		t.Errorf("Unexpected error creating htpasswd file %v: %v", tmpfile, err)
-	}
-}
-
-func TestDumpSecretAuthMap(t *testing.T) {
-	tmpfile, dir, s := dummySecretContent(t)
-	defer os.RemoveAll(dir)
-
-	err := dumpSecretAuthMap(tmpfile, s)
+	err = dumpSecret(tmpfile, s)
 	if err != nil {
 		t.Errorf("Unexpected error creating htpasswd file %v: %v", tmpfile, err)
 	}
diff --git a/internal/ingress/controller/config/config_test.go b/internal/ingress/controller/config/config_test.go
index b27922fe7..2c730d71e 100644
--- a/internal/ingress/controller/config/config_test.go
+++ b/internal/ingress/controller/config/config_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package config
 
 import (
+	"fmt"
 	"testing"
 )
 
@@ -27,6 +28,8 @@ func TestBuildLogFormatUpstream(t *testing.T) {
 		curLogFormat     string
 		expected         string
 	}{
+		{true, logFormatUpstream, fmt.Sprintf(logFormatUpstream, "$the_real_ip")},
+		{false, logFormatUpstream, fmt.Sprintf(logFormatUpstream, "$the_real_ip")},
 		{true, "my-log-format", "my-log-format"},
 		{false, "john-log-format", "john-log-format"},
 	}
diff --git a/test/data/config.json b/test/data/config.json
index e63e8318c..90798a244 100644
--- a/test/data/config.json
+++ b/test/data/config.json
@@ -46,7 +46,7 @@
 		"useHttp2": true,
 		"proxyStreamTimeout": "600s",
 		"workerProcesses": 1,
-		"limitConnZoneVariable": "$remote_addr"
+		"limitConnZoneVariable": "$the_real_ip"
 	},
 	"customErrors": true,
 	"defResolver": "",
diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go
index df4f62721..726e94de0 100644
--- a/test/e2e/annotations/auth.go
+++ b/test/e2e/annotations/auth.go
@@ -183,37 +183,6 @@ var _ = framework.IngressNginxDescribe("Annotations - Auth", func() {
 		Expect(resp.StatusCode).Should(Equal(http.StatusOK))
 	})
 
-	It("should return status code 200 when authentication is configured with a map and Authorization header is sent", func() {
-		host := "auth"
-
-		s := f.EnsureSecret(buildMapSecret("foo", "bar", "test", f.Namespace))
-
-		annotations := map[string]string{
-			"nginx.ingress.kubernetes.io/auth-type":        "basic",
-			"nginx.ingress.kubernetes.io/auth-secret":      s.Name,
-			"nginx.ingress.kubernetes.io/auth-secret-type": "auth-map",
-			"nginx.ingress.kubernetes.io/auth-realm":       "test auth",
-		}
-
-		ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, &annotations)
-		f.EnsureIngress(ing)
-
-		f.WaitForNginxServer(host,
-			func(server string) bool {
-				return Expect(server).Should(ContainSubstring("server_name auth"))
-			})
-
-		resp, _, errs := gorequest.New().
-			Get(f.GetURL(framework.HTTP)).
-			Retry(10, 1*time.Second, http.StatusNotFound).
-			Set("Host", host).
-			SetBasicAuth("foo", "bar").
-			End()
-
-		Expect(errs).Should(BeEmpty())
-		Expect(resp.StatusCode).Should(Equal(http.StatusOK))
-	})
-
 	It("should return status code 500 when authentication is configured with invalid content and Authorization header is sent", func() {
 		host := "auth"
 
@@ -577,20 +546,3 @@ func buildSecret(username, password, name, namespace string) *corev1.Secret {
 		Type: corev1.SecretTypeOpaque,
 	}
 }
-
-func buildMapSecret(username, password, name, namespace string) *corev1.Secret {
-	out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput()
-	Expect(err).NotTo(HaveOccurred())
-
-	return &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:                       name,
-			Namespace:                  namespace,
-			DeletionGracePeriodSeconds: framework.NewInt64(1),
-		},
-		Data: map[string][]byte{
-			username: []byte(out),
-		},
-		Type: corev1.SecretTypeOpaque,
-	}
-}