2

I am trying to figure out how to enable the proxy protocol header in GKE.

Usually, you can do it with gcloud:

gcloud compute target-ssl-proxies update my-ssl-lb-target-proxy \
    --proxy-header=PROXY_V1

https://cloud.google.com/load-balancing/docs/tcp/setting-up-tcp#update_proxy_protocol_header_for_target_tcp_proxy

But GKE doesn't list it up as annotation:

https://cloud.google.com/kubernetes-engine/docs/how-to/service-parameters

Isn't there any support yet? :(

Thanks

zemicolon
  • 152
  • 1
  • 13

1 Answers1

3

When you create a Service of type "LoadBalancer" in GKE, it uses a Network Load Balancer for external services and an Internal TCP/UDP Load Balancer for internal services.

You can use TCP and/or SSL Proxy load balancers as well, but it involves a bit of manual configuration. You will need to create a Standalone NEG and then associate that as the backend of a TCP or SSL Proxy LB.

To create a Standalone NEG, you create a Service of type ClusterIP and use a neg annotation:

apiVersion: v1
kind: Service
metadata:
  name: neg-demo-svc
  annotations:
    cloud.google.com/neg: '{"exposed_ports": {"80":{"name": "NEG_NAME"}}}'
spec:
  type: ClusterIP
  selector:
    run: neg-demo-app # Selects Pods labelled run: neg-demo-app
  ports:
  - port: 80
    protocol: TCP
    targetPort: 9376

You'd then associate the NEG with the backend service used by your TCP or SSL Proxy LB, for example

gcloud compute backend-services add-backend my-bes \
    --global \
    --network-endpoint-group=NEG_NAME
    ...
Gari Singh
  • 11,418
  • 2
  • 18
  • 41
  • Do you know if there is already a (open source) controller for this task? – zemicolon Jun 08 '22 at 11:59
  • 1
    Not that I know of at this point. There is an open request internally to make this easier and I believe we plan to support configuring this in the future via the Gateway controller. – Gari Singh Jun 08 '22 at 14:28
  • Thank you, Gari. I would love to see Google open sources their Gateway controller in the same fashion they did with their Ingress controller. – zemicolon Jun 08 '22 at 15:05