-
Notifications
You must be signed in to change notification settings - Fork 711
Support downstream and upstream Proxy Protocol #1328
Description
Envoy Gateway should support Proxy Protocol on traffic coming from the world to support for example cases of Network Load Balancers from some cloud providers (AWS example from Emissary Ingress docs) and other cases when we have some sort of L4 LB in front of the K8S cluster.
It should also support Proxy Protocol on egress traffic to support cases where eg. pointing to ExternalService outside of the cluster or we just need raw L4 socket (TCP or UDP) and source IP preservation.
I actually need the second case, but I know there are lots of people needing first one due to cloud deployments with L4 LBs in front of the k8s.
Istio for example has 2 issues for upstream proxy proto (istio/istio#42257, istio/istio#44342) and some forum posts from people implementing it with EnvoyFilter mechanism and it also has example of configuration in docs for downstream proxy proto due to cloud usage.
Upstream proxy protocol would for example allow placing nginx ingress controler behind Envoy Gateway without losing the source IPs when someone needs legacy ingress resource support: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-proxy-protocol