4 ms·

nginx can inject proxy_protocol - I know because I've enabled it by mistake! The kubernetes nginx ingress controller doesn't support it though. I think that i

nginx can inject proxy_protocol - I know because I've enabled it by mistake! The kubernetes nginx ingress controller doesn't support it though. I think that is because most people use HTTP headers (X-Forwarded-For) instead. But if you do want it, you should open an issue explaining the use case so we can check our assumptions!

sandGorgon 10y ago
@justinsb - ur the expert here and i will not dispute this :D I still believe that there is NO better tool to use kubernetes than kops. I now use the 100.64 subnet that you guys figured out ("carrier grade NAT" seriously?) in docker swarm. but genuine question - can u show me how ? Because I honestly went crawling into the nginx codebase and could only find client side handling of proxy protocol. I found NO place where it showed how it could be injected and chain reverse proxies together (that is what it was invented for in the first place). P.S. just a quick google reveals this link which sort of confirms my suspicion - http://blog.haproxy.com/haproxy/proxy-protocol/ http://blog.haproxy.com/haproxy/proxy-protocol/
- justinsb 10y ago
  It's the same proxy_protocol keyword for both, which is why this is so confusing. In the listen line it means "remove proxy protocol from the inbound connection", as a top level directive "proxy_protocol on" on the server it means "add proxy protocol to the outbound connection" This commit should show the difference: https://github.com/kubernetes/ingress/commit/6fa461c2a7891b4f20fffd1c9f7fe2fce5085cd3 https://github.com/kubernetes/ingress/commit/6fa461c2a7891b4... This is the nginx function AFAICT: https://github.com/nginx/nginx/blob/b580770f3afaeec48a15cb8c9d2f9cf72b14e4da/src/stream/ngx_stream_proxy_module.c#L909 https://github.com/nginx/nginx/blob/b580770f3afaeec48a15cb8c... Looking at that though, maybe it only works with SSL passthrough... but that is the typical use-case for using proxy protocol instead of X-Forwarded-For

sandGorgon 10y ago

@justinsb - ur the expert here and i will not dispute this :D I still believe that there is NO better tool to use kubernetes than kops. I now use the 100.64 subnet that you guys figured out ("carrier grade NAT" seriously?) in docker swarm. but genuine question - can u show me how ? Because I honestly went crawling into the nginx codebase and could only find client side handling of proxy protocol. I found NO place where it showed how it could be injected and chain reverse proxies together (that is what it was invented for in the first place). P.S. just a quick google reveals this link which sort of confirms my suspicion - http://blog.haproxy.com/haproxy/proxy-protocol/ http://blog.haproxy.com/haproxy/proxy-protocol/

justinsb 10y ago
It's the same proxy_protocol keyword for both, which is why this is so confusing. In the listen line it means "remove proxy protocol from the inbound connection", as a top level directive "proxy_protocol on" on the server it means "add proxy protocol to the outbound connection" This commit should show the difference: https://github.com/kubernetes/ingress/commit/6fa461c2a7891b4f20fffd1c9f7fe2fce5085cd3 https://github.com/kubernetes/ingress/commit/6fa461c2a7891b4... This is the nginx function AFAICT: https://github.com/nginx/nginx/blob/b580770f3afaeec48a15cb8c9d2f9cf72b14e4da/src/stream/ngx_stream_proxy_module.c#L909 https://github.com/nginx/nginx/blob/b580770f3afaeec48a15cb8c... Looking at that though, maybe it only works with SSL passthrough... but that is the typical use-case for using proxy protocol instead of X-Forwarded-For