k8s/baseline
k8s/baseline
3
0
Fork 0
Code Issues 1 Pull requests Releases Activity

DOC: add instructions for hairpin-proxy

Browse source
This commit is contained in:
Sebastian Mark 2022-02-03 08:28:40 +01:00
parent dd730bd1d2
commit d745d5245d
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
README.md
View file

@ -13,13 +13,25 @@
ProxyProtocol needs to be enabled for ingress-nginx to see the clients IP in ingress log. ProxyProtocol needs to be enabled for ingress-nginx to see the clients IP in ingress log.
Add the ProxyProtocol annotation to the ingress-nginx service: Add the ProxyProtocol annotation to the ingress-nginx service:
``` ```
annotations: annotations:
service.beta.kubernetes.io/linode-loadbalancer-proxy-protocol: v2 service.beta.kubernetes.io/linode-loadbalancer-proxy-protocol: v2
``` ```
Update the ingress-nginx ConfigMap to make nginx expect ProxyProtocol data: Update the ingress-nginx ConfigMap to make nginx expect ProxyProtocol data:
``` ```
data: data:
use-proxy-protocol: "true" use-proxy-protocol: "true"
``` ```
#### cert-manager
> However, when you have the PROXY protocol enabled, the external load balancer does modify the traffic, prepending the PROXY line before each TCP connection. If you connect directly to the web server internally, bypassing the external load balancer, then it will receive traffic without the PROXY line.
>
> This is particularly a problem when using cert-manager for provisioning SSL certificates.
After enabling the PROXY protocol cert-manager is unable to perform a self check ("propagation check failed", "failed to perform self check GET request").
[hairpin-proxy](https://github.com/compumike/hairpin-proxy) adds PROXY protocol support for internal-to-LoadBalancer traffic for Kubernetes Ingress users, specifically for cert-manager self-checks (no further configuration needed).