MINOR: gate: add accept-proxy option for the listener binds - #29
Open
loliee wants to merge 1 commit into
Open
Conversation
Behind a load balancer that proxies the TCP connection, HAProxy sees the load balancer's address as the client, whatever the Service's external traffic policy says. Such load balancers hand the real address over with the PROXY protocol, which needs accept-proxy on the bind, and the controller only ever sets ssl and crt-list on its binds. Add the --accept-proxy controller flag, off by default. When set, every bind of a frontend generated from a Gateway listener gets accept-proxy: HTTP, HTTPS and TLS passthrough alike, since they all sit behind the same load balancer. The stats frontend is left alone: probes and scrapers reach the pod directly, without the header. A global flag rather than a per-Gateway setting: whether the header is sent is a property of the load balancer in front of the controller's Service, shared by every listener published on it, and the Gateway API has no standard field for it. Cilium exposes it the same way; others use a policy resource of their own. The unit test covers the three protocol categories with the flag on and off; the options documentation is regenerated. Signed-off-by: Maxime Loliée <maxime.loliee@mediapart.fr>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the patch I mentioned in #28. Behind a load balancer that proxies
the TCP connection (Octavia on OVHcloud in our case), HAProxy only sees the
load balancer's address, and the PROXY protocol that fixes it needs
accept-proxyon the binds, which the controller never sets.Description
This PR add a new controller option, off by default, done like the existing ones in
k8s/gate/options:opt.AcceptProxy()setsHaproxyParams.AcceptProxyhugbinary exposes it as--accept-proxy, wired like--disable-ipv4,so it can be passed with
controller.extraArgsin the chartbindParams()carries it intomodels.BindParams.AcceptProxy, whichclient-nativealready serializes asaccept-proxyfrontends_test.go, anddocumentation/controller-options.*regenerated
Tests
go test ./k8s/gate/haproxy/ -run TestBindParamsAcceptProxypasses,task format,task generateandtask lintleave the tree cleanloadbalancer.openstack.org/proxy-protocol: "v2"on the Service and
--accept-proxyincontroller.extraArgs: the generatedhaproxy.cfgshowsaccept-proxyon thehug_http_80andhug_https_443binds, and
%ciin the access log is the real client IP, both for externalclients and for connections that hairpin through the load balancer from
inside the cluster
header bytes, and without the annotation the flag makes every connection get
rejected, as expected
tcpSocketreadiness probe keeps working: a connection closed without datais not a PROXY protocol error, and
option dontlognullkeeps it out of the logs