search

kubernetes / ingress-nginx

Ingress NGINX Controller for Kubernetes
https://kubernetes.github.io/ingress-nginx/
Apache License 2.0
17.59k stars 8.27k forks source link

Configure use of Proxy-Protocol seperately for HTTP/HTTPS inbound traffic #12207

Open FelixDobler opened 1 month ago

FelixDobler commented 1 month ago

Wanted Feature

I would like to enable proxy-protocol for the incoming HTTPS connections but keep it disabled for HTTP.

Use Case

I have another nginx instance in front of the Ingress-Nginx that acts as a reverse proxy for HTTP and HTTPS traffic. The routing for HTTPS is done using SNI inside a stream block and the traffic forwarded using proxy-protocol. For HTTP the Host Header of the request needs to be inspected to determine the correct backend. For that, the http block is used, which doesn't allow forwarding using proxy-protocol. Instead the usual Headers can be used to preserve the original client IP-Address.

Change required?

I'm not entirely familiar with the templating system used for the nginx config in the nginx template and therefore am not sure if this behavior could be achieved there. Otherwise, adjustment in the buildHTTP(S)Listener would be required.

Additionally the real-ip-header would need to be separately configured for the HTTP and HTTPS listener.

Feasibility

Nginx allows for enabling proxy_protocol per listen directive, so it is viable from the underlying nginx software.

k8s-ci-robot commented 1 month ago

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
longwuyuan commented 1 month ago

I had assumed that the proxy-protocol headers are set for the entire connection and can not be optionally set for HTTP or HTTPS. I am not a developer though.

The project does not have resources as all resources are occupied with security, stability and implementation of the Gateway-API. Hence I would not expect any traction on this.

Wait for other comments.

strongjz commented 1 month ago

/assign @Gacko