Greptile Summary

This PR adds opt-in PROXY protocol v2 (PP2) support for UDS Core Istio gateways by deploying an EnvoyFilter in permissive mode (allow_requests_without_proxy_protocol: true), solving the incompatibility between Istio's global strict-mode PP2 setting and in-cluster mesh traffic. It is scoped per-gateway via a new proxyProtocol.enabled value in the uds-istio-config Helm chart.

• Adds proxy-protocol-envoyfilter.yaml template that creates an EnvoyFilter with INSERT_FIRST on the LISTENER_FILTER chain when proxyProtocol.enabled: true, with explicit warnings in values.yaml about the source-IP spoofing trust boundary.
• Adds helm-unittest coverage for enabled/disabled states across tenant and admin gateways.
• Adds a comprehensive how-to guide with caution callouts, troubleshooting steps, and verification commands.

Confidence Score: 5/5

Safe to merge — the EnvoyFilter is opt-in (disabled by default), uses permissive mode to protect in-cluster traffic, and is properly scoped to individual gateway workloads.

The implementation is correct: INSERT_FIRST on LISTENER_FILTER ensures PP2 is parsed before TLS inspection, permissive mode keeps in-cluster mesh traffic working, and the EnvoyFilter workloadSelector scopes it tightly to the specific gateway pod. Tests cover all key render/no-render paths. Default is false, so existing deployments are unaffected.

No files require special attention.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant NLB as Upstream NLB
    participant EF as Envoy (proxy_protocol filter INSERT_FIRST, permissive)
    participant GW as Istio Gateway Listener
    participant Mesh as In-cluster Mesh Traffic

    NLB->>EF: TCP connection + PP2 header (real client IP)
    Note over EF: Parses PP2 header, extracts source IP
    EF->>GW: Forwards with source IP metadata
    GW-->>NLB: Response

    Mesh->>EF: TCP connection (no PP2 header)
    Note over EF: allow_requests_without_proxy_protocol=true, passes through
    EF->>GW: Forwards (mesh source IP unchanged)
    GW-->>Mesh: Response (SSO flows intact)

_{Reviews (3): Last reviewed commit: "chore: address feedback and callout admi..." | Re-trigger Greptile}

@greptileai review