Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configure use of Proxy-Protocol seperately for HTTP/HTTPS inbound traffic #12207

Open
FelixDobler opened this issue Oct 17, 2024 · 3 comments
Open
Assignees
Labels
kind/feature Categorizes issue or PR as related to a new feature. needs-priority needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one.

Comments

@FelixDobler
Copy link

FelixDobler commented Oct 17, 2024

Wanted Feature

I would like to enable proxy-protocol for the incoming HTTPS connections but keep it disabled for HTTP.

Use Case

I have another nginx instance in front of the Ingress-Nginx that acts as a reverse proxy for HTTP and HTTPS traffic.
The routing for HTTPS is done using SNI inside a stream block and the traffic forwarded using proxy-protocol.
For HTTP the Host Header of the request needs to be inspected to determine the correct backend. For that, the http block is used, which doesn't allow forwarding using proxy-protocol. Instead the usual Headers can be used to preserve the original client IP-Address.

Change required?

I'm not entirely familiar with the templating system used for the nginx config in the nginx template and therefore am not sure if this behavior could be achieved there.
Otherwise, adjustment in the buildHTTP(S)Listener would be required.

Additionally the real-ip-header would need to be separately configured for the HTTP and HTTPS listener.

Feasibility

Nginx allows for enabling proxy_protocol per listen directive, so it is viable from the underlying nginx software.

@FelixDobler FelixDobler added the kind/feature Categorizes issue or PR as related to a new feature. label Oct 17, 2024
@k8s-ci-robot k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Oct 17, 2024
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@longwuyuan
Copy link
Contributor

I had assumed that the proxy-protocol headers are set for the entire connection and can not be optionally set for HTTP or HTTPS. I am not a developer though.

The project does not have resources as all resources are occupied with security, stability and implementation of the Gateway-API. Hence I would not expect any traction on this.

Wait for other comments.

@strongjz
Copy link
Member

/assign @Gacko

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Categorizes issue or PR as related to a new feature. needs-priority needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one.
Projects
Development

No branches or pull requests

5 participants