Skip to content

Commit 7fb59de

Browse files
salonichf5salonichf5
committed
add proxy_protocol to server configuration
1 parent 1476fe0 commit 7fb59de

File tree

13 files changed

+133
-13
lines changed

13 files changed

+133
-13
lines changed

‎apis/v1alpha1/nginxproxy_types.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,12 @@ type NginxProxySpec struct {
5858
//
5959
// +optional
6060
DisableHTTP2 bool `json:"disableHTTP2,omitempty"`
61+
62+
// EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
63+
// Default is false, meaning the Proxy Protocol will be disabled.
64+
//
65+
// +optional
66+
EnableProxyProtocol bool `json:"enableProxyProtocol,omitempty"`
6167
}
6268

6369
// Telemetry specifies the OpenTelemetry configuration.

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ nginx:
9393
{}
9494
# disableHTTP2: false
9595
# ipFamily: dual
96+
# enableProxyProtocol: true
9697
# telemetry:
9798
# exporter:
9899
# endpoint: otel-collector.default.svc:4317

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ spec:
5252
DisableHTTP2 defines if http2 should be disabled for all servers.
5353
Default is false, meaning http2 will be enabled for all servers.
5454
type: boolean
55+
enableProxyProtocol:
56+
description: |-
57+
EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
58+
Default is false, meaning the Proxy Protocol will be disabled.
59+
type: boolean
5560
ipFamily:
5661
default: dual
5762
description: |-

‎deploy/crds.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -697,6 +697,11 @@ spec:
697697
DisableHTTP2 defines if http2 should be disabled for all servers.
698698
Default is false, meaning http2 will be enabled for all servers.
699699
type: boolean
700+
enableProxyProtocol:
701+
description: |-
702+
EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
703+
Default is false, meaning the Proxy Protocol will be disabled.
704+
type: boolean
700705
ipFamily:
701706
default: dual
702707
description: |-

‎internal/mode/static/nginx/config/http/config.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ type ProxySSLVerify struct {
115115

116116
// ServerConfig holds configuration for an HTTP server and IP family to be used by NGINX.
117117
type ServerConfig struct {
118-
Servers []Server
119-
IPFamily IPFamily
118+
Servers []Server
119+
IPFamily IPFamily
120+
ProxyProtocol bool
120121
}

‎internal/mode/static/nginx/config/servers.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,9 @@ func executeServers(conf dataplane.Configuration) []executeResult {
6161
servers, httpMatchPairs := createServers(conf.HTTPServers, conf.SSLServers)
6262

6363
serverConfig := http.ServerConfig{
64-
Servers: servers,
65-
IPFamily: getIPFamily(conf.BaseHTTPConfig),
64+
Servers: servers,
65+
IPFamily: getIPFamily(conf.BaseHTTPConfig),
66+
ProxyProtocol: conf.BaseHTTPConfig.ProxyProtocol,
6667
}
6768

6869
serverResult := executeResult{

‎internal/mode/static/nginx/config/servers_template.go

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,26 @@ package config
22

33
const serversTemplateText = `
44
js_preload_object matches from /etc/nginx/conf.d/matches.json;
5+
{{ $proxyProtocol := "" }}{{ if $.ProxyProtocol }}{{ $proxyProtocol = " proxy_protocol" }}{{ end }}
56
{{- range $s := .Servers -}}
67
{{ if $s.IsDefaultSSL -}}
78
server {
89
{{- if $.IPFamily.IPv4 }}
9-
listen {{ $s.Port }} ssl default_server;
10+
listen {{ $s.Port }} ssl default_server{{ $proxyProtocol }};
1011
{{- end }}
1112
{{- if $.IPFamily.IPv6 }}
12-
listen [::]:{{ $s.Port }} ssl default_server;
13+
listen [::]:{{ $s.Port }} ssl default_server{{ $proxyProtocol }};
1314
{{- end }}
1415
1516
ssl_reject_handshake on;
1617
}
1718
{{- else if $s.IsDefaultHTTP }}
1819
server {
1920
{{- if $.IPFamily.IPv4 }}
20-
listen {{ $s.Port }} default_server;
21+
listen {{ $s.Port }} default_server{{ $proxyProtocol }};
2122
{{- end }}
2223
{{- if $.IPFamily.IPv6 }}
23-
listen [::]:{{ $s.Port }} default_server;
24+
listen [::]:{{ $s.Port }} default_server{{ $proxyProtocol }};
2425
{{- end }}
2526
2627
default_type text/html;
@@ -30,10 +31,10 @@ server {
3031
server {
3132
{{- if $s.SSL }}
3233
{{- if $.IPFamily.IPv4 }}
33-
listen {{ $s.Port }} ssl;
34+
listen {{ $s.Port }} ssl{{ $proxyProtocol }};
3435
{{- end }}
3536
{{- if $.IPFamily.IPv6 }}
36-
listen [::]:{{ $s.Port }} ssl;
37+
listen [::]:{{ $s.Port }} ssl{{ $proxyProtocol }};
3738
{{- end }}
3839
ssl_certificate {{ $s.SSL.Certificate }};
3940
ssl_certificate_key {{ $s.SSL.CertificateKey }};
@@ -43,10 +44,10 @@ server {
4344
}
4445
{{- else }}
4546
{{- if $.IPFamily.IPv4 }}
46-
listen {{ $s.Port }};
47+
listen {{ $s.Port }}{{ $proxyProtocol }};
4748
{{- end }}
4849
{{- if $.IPFamily.IPv6 }}
49-
listen [::]:{{ $s.Port }};
50+
listen [::]:{{ $s.Port }}{{ $proxyProtocol }};
5051
{{- end }}
5152
{{- end }}
5253

‎internal/mode/static/nginx/config/servers_test.go

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ func TestExecuteServers(t *testing.T) {
137137
}
138138
}
139139

140-
func TestExecuteServersForIPFamily(t *testing.T) {
140+
func TestExecuteServerConfig(t *testing.T) {
141141
httpServers := []dataplane.VirtualServer{
142142
{
143143
IsDefault: true,
@@ -230,6 +230,30 @@ func TestExecuteServersForIPFamily(t *testing.T) {
230230
"listen [::]:8443 ssl;": 1,
231231
},
232232
},
233+
{
234+
msg: "http and ssl servers with proxy protocol enabled",
235+
config: dataplane.Configuration{
236+
HTTPServers: httpServers,
237+
SSLServers: sslServers,
238+
BaseHTTPConfig: dataplane.BaseHTTPConfig{
239+
ProxyProtocol: true,
240+
},
241+
},
242+
expectedHTTPConfig: map[string]int{
243+
"listen 8080 default_server proxy_protocol;": 1,
244+
"listen 8080 proxy_protocol;": 1,
245+
"listen 8443 ssl default_server proxy_protocol;": 1,
246+
"listen 8443 ssl proxy_protocol;": 1,
247+
"server_name example.com;": 2,
248+
"ssl_certificate /etc/nginx/secrets/test-keypair.pem;": 1,
249+
"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;": 1,
250+
"ssl_reject_handshake on;": 1,
251+
"listen [::]:8080 default_server proxy_protocol;": 1,
252+
"listen [::]:8080 proxy_protocol;": 1,
253+
"listen [::]:8443 ssl default_server proxy_protocol;": 1,
254+
"listen [::]:8443 ssl proxy_protocol;": 1,
255+
},
256+
},
233257
}
234258

235259
for _, test := range tests {

‎internal/mode/static/state/dataplane/configuration.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -678,6 +678,8 @@ func buildBaseHTTPConfig(g *graph.Graph) BaseHTTPConfig {
678678
// HTTP2 should be enabled by default
679679
HTTP2: true,
680680
IPFamily: Dual,
681+
// EnableProxyProtocol should be disabled by default
682+
ProxyProtocol: false,
681683
}
682684
if g.NginxProxy == nil || !g.NginxProxy.Valid {
683685
return baseConfig
@@ -696,6 +698,10 @@ func buildBaseHTTPConfig(g *graph.Graph) BaseHTTPConfig {
696698
}
697699
}
698700

701+
if g.NginxProxy.Source.Spec.EnableProxyProtocol {
702+
baseConfig.ProxyProtocol = true
703+
}
704+
699705
return baseConfig
700706
}
701707

‎internal/mode/static/state/dataplane/configuration_test.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2089,6 +2089,34 @@ func TestBuildConfiguration(t *testing.T) {
20892089
}),
20902090
msg: "NginxProxy with IPv6 IPFamily and no routes",
20912091
},
2092+
{
2093+
graph: getModifiedGraph(func(g *graph.Graph) *graph.Graph {
2094+
g.Gateway.Source.ObjectMeta = metav1.ObjectMeta{
2095+
Name: "gw",
2096+
Namespace: "ns",
2097+
}
2098+
g.Gateway.Listeners = append(g.Gateway.Listeners, &graph.Listener{
2099+
Name: "listener-80-1",
2100+
Source: listener80,
2101+
Valid: true,
2102+
Routes: map[graph.RouteKey]*graph.L7Route{},
2103+
})
2104+
g.NginxProxy = &graph.NginxProxy{
2105+
Valid: true,
2106+
Source: &ngfAPI.NginxProxy{
2107+
Spec: ngfAPI.NginxProxySpec{EnableProxyProtocol: true},
2108+
},
2109+
}
2110+
return g
2111+
}),
2112+
expConf: getModifiedExpectedConfiguration(func(conf Configuration) Configuration {
2113+
conf.SSLServers = []VirtualServer{}
2114+
conf.SSLKeyPairs = map[SSLKeyPairID]SSLKeyPair{}
2115+
conf.BaseHTTPConfig = BaseHTTPConfig{HTTP2: true, IPFamily: Dual, ProxyProtocol: true}
2116+
return conf
2117+
}),
2118+
msg: "NginxProxy with proxy protocol enabled",
2119+
},
20922120
}
20932121

20942122
for _, test := range tests {

‎internal/mode/static/state/dataplane/types.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,8 @@ type BaseHTTPConfig struct {
300300
IPFamily IPFamilyType
301301
// HTTP2 specifies whether http2 should be enabled for all servers.
302302
HTTP2 bool
303+
// ProxyProtocol specifies whether the Proxy Protocol should be enabled for all servers.
304+
ProxyProtocol bool
303305
}
304306

305307
// IPFamilyType specifies the IP family to be used by NGINX.

‎site/content/how-to/monitoring/troubleshooting.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,20 @@ To **resolve** this, you can do one of the following:
439439
440440
- Adjust the IPFamily of your Service to match that of the NginxProxy configuration.
441441
442+
##### Broken Header Error
443+
444+
If you check your _nginx_ container logs and see the following error:
445+
446+
```text
447+
2024/07/25 00:50:45 [error] 211#211: *22 broken header: "GET /coffee HTTP/1.1" while reading PROXY protocol, client: 127.0.0.1, server: 0.0.0.0:80
448+
```
449+
450+
It indicates that `proxy_protocol` is enabled for the gateway listeners but the request sent to the application endpoint does not contain proxy information.To **resolve** this, you can do one of the following:
451+
452+
- Update the NginxProxy configuration with [`enableProxyProtocol`](({{< relref "reference/api.md" >}})) disabled.
453+
454+
- Send valid proxy information with requests being handled by your application.
455+
442456
### Further reading
443457
444458
You can view the [Kubernetes Troubleshooting Guide](https://kubernetes.io/docs/tasks/debug/debug-application/) for more debugging guidance.

‎site/content/reference/api.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,19 @@ bool
339339
Default is false, meaning http2 will be enabled for all servers.</p>
340340
</td>
341341
</tr>
342+
<tr>
343+
<td>
344+
<code>enableProxyProtocol</code><br/>
345+
<em>
346+
bool
347+
</em>
348+
</td>
349+
<td>
350+
<em>(Optional)</em>
351+
<p>EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
352+
Default is false, meaning the Proxy Protocol will be disabled.</p>
353+
</td>
354+
</tr>
342355
</table>
343356
</td>
344357
</tr>
@@ -961,6 +974,19 @@ bool
961974
Default is false, meaning http2 will be enabled for all servers.</p>
962975
</td>
963976
</tr>
977+
<tr>
978+
<td>
979+
<code>enableProxyProtocol</code><br/>
980+
<em>
981+
bool
982+
</em>
983+
</td>
984+
<td>
985+
<em>(Optional)</em>
986+
<p>EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
987+
Default is false, meaning the Proxy Protocol will be disabled.</p>
988+
</td>
989+
</tr>
964990
</tbody>
965991
</table>
966992
<h3 id="gateway.nginx.org/v1alpha1.ObservabilityPolicySpec">ObservabilityPolicySpec

0 commit comments

Comments
 (0)