GKE Load Balancer - Proxy protocol with whitelist-source-range about ingress-nginx HOT 8 OPEN

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

from ingress-nginx.

/remove-kind bug

• Please show proof screenshot that proxy-protocol is enabled on GCP LB
• Please show proof kubectl command output that proxy-protocol is enabled on controller
• Please remove the yaml info and please show the kubectl describe output for the related resources
• You have not answered many questions asked in the template so please answer them in MD format
• Please show real actual curl command used to make HTTP request
• Please show the actual logs of the controller pod so the logmessages of the curl related request are visible

from ingress-nginx.

/triage needs-information

from ingress-nginx.

• Please show proof screenshot that proxy-protocol is enabled on GCP LB
  I can't edit GCP load balancer, poxy-protocol checkbox is not visible (I was following nginx docs, end up here, but proxy-protocol wasn't visible)

• Please show proof kubectl command output that proxy-protocol is enabled on controller
  Issue edited. kubectl describe cm -n ingress-nginx ingress-nginx-controller is fine?

• Please remove the yaml info and please show the kubectl describe output for the related resources
  There is ingress-nginx pod, configmap and services describe, anything else?

• You have not answered many questions asked in the template so please answer them in MD format
  I think those unanswered questions werre answered in other bulletpoint, anything more than present is essential?

• Please show real actual curl command used to make HTTP request
  Done.

• Please show the actual logs of the controller pod so the logmessages of the curl related request are visible
  I think that was done before but updated it anyway.

from ingress-nginx.

• Your clusterIP addresses are valid C class internet ipaddresses. I don't understand
• Without knowing that GCP LB has been enabled for proxy-protocol, I am not sure what to do

from ingress-nginx.

It seems I don't understand something. I don't use loadbalancer creted "by" GCP. If uninstall nginx-controller from my cluster there will be no loadbalancers listed in GCP thus I assume the only LB I have is the nginx one created in cluster.

from ingress-nginx.

• GKE private cluster with Autopilot is out of scope of discussion here
• Ingress Controllers create Kubernetes Objects
• One of the K8S objects created by the ingress-nginx controller is a K8S object of "kind: service" of "--type LoadBalancer"
• Anytime anyone creates a service of --type LoadBalancer in Kubernetes, it provisions a LoadBalancer object on the infra-provider like AWS/GCP/Azure/Other. If on-premises, then most often there is a software like Metallb.org which provides the same functionality as a LB from AWS/GCP/Azure
• Since you made the comment above and after considering your values file spec "networking.gke.io/load-balancer-type: Internal", I think you should delete the installation of the ingress-controller and make sure all resources related to the ingress-nginx controller are deleted
• Then I think you should follow the documentaiton https://kubernetes.github.io/ingress-nginx/deploy/#gce-gke
• I also think you should install one controller for external and another conroller for internal as per this https://kubernetes.github.io/ingress-nginx/user-guide/k8s-122-migration/#how-can-i-easily-install-multiple-instances-of-the-ingress-nginx-controller-in-the-same-cluster
• And I think you should enable proxy-protocol on the GCP LB as per https://cloud.google.com/load-balancing/docs/tcp/setting-up-tcp#proxy-protocol
• And you already know how to enable proxy-protocol on the controller https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-proxy-protocol

from ingress-nginx.

/assign

from ingress-nginx.