Skip to content

Commit 8eafa13

Browse files
gcs278gcs278
committed
OCPBUGS-63219: Add clientIPPreservationMode to AWS NLB parameters
Add clientIPPreservationMode field to AWSNetworkLoadBalancerParameters to control how client IP addresses are preserved. The field accepts "Native" (uses AWS's native client IP preservation, the default) and "ProxyProtocol" (uses PROXY protocol v2). When set to Native, the NLB target group has preserve_client_ip.enabled set to true, which may cause hairpin connection failures for internal load balancers when connections are made from pods to router pods on the same node. When set to ProxyProtocol, the NLB target group has preserve_client_ip.enabled set to false and proxy_protocol_v2.enabled set to true. This allows backends to receive the original client IP via PROXY protocol headers while avoiding hairpin connection failures.
1 parent 4f63a40 commit 8eafa13

11 files changed

Lines changed: 392 additions & 3 deletions

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38292,6 +38292,10 @@
3829238292
"description": "synchronizedAPI holds the last stable value of authoritativeAPI. It is used to detect migration cancellation requests and to restore the resource to its previous state. Valid values are \"MachineAPI\" and \"ClusterAPI\". When omitted, the resource has not yet been reconciled by the migration controller.",
3829338293
"type": "string"
3829438294
},
38295+
"synchronizedAPI": {
38296+
"description": "synchronizedAPI holds the last stable value of authoritativeAPI. It is used to detect migration cancellation requests and to restore the resource to its previous state. Valid values are \"MachineAPI\" and \"ClusterAPI\". When omitted, the resource has not yet been reconciled by the migration controller.",
38297+
"type": "string"
38298+
},
3829538299
"synchronizedGeneration": {
3829638300
"description": "synchronizedGeneration is the generation of the authoritative resource that the non-authoritative resource is synchronised with. This field is set when the authoritative resource is updated and the sync controller has updated the non-authoritative resource to match.",
3829738301
"type": "integer",
@@ -41555,12 +41559,30 @@
4155541559
},
4155641560
"x-kubernetes-list-type": "atomic"
4155741561
},
41562+
"proxyProtocol": {
41563+
"description": "proxyProtocol enables PROXY protocol on the Network Load Balancer's target groups.\n\nWhen enabled, the NLB will prepend a PROXY protocol header to each TCP connection that contains the original source and destination IP addresses and ports. This allows the backend to see the true client IP address while preserving the ability to handle hairpin connections (connections from pods to a service that targets those same pods).\n\nWhen enabled, the NLB target group attribute `preserve_client_ip.enabled` is set to false and `proxy_protocol_v2.enabled` is set to true. Application backends must be configured to parse the PROXY protocol header to extract the original client IP address.\n\nWhen this field is not set or set to false, client IP preservation is enabled (the default AWS NLB behavior), which may cause hairpin connection failures for internal load balancers.\n\nSee https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocol for more information about PROXY protocol support on AWS Network Load Balancers.",
41564+
"$ref": "#/definitions/com.github.openshift.api.operator.v1.AWSProxyProtocol"
41565+
},
4155841566
"subnets": {
4155941567
"description": "subnets specifies the subnets to which the load balancer will attach. The subnets may be specified by either their ID or name. The total number of subnets is limited to 10.\n\nIn order for the load balancer to be provisioned with subnets, each subnet must exist, each subnet must be from a different availability zone, and the load balancer service must be recreated to pick up new values.\n\nWhen omitted from the spec, the subnets will be auto-discovered for each availability zone. Auto-discovered subnets are not reported in the status of the IngressController object.",
4156041568
"$ref": "#/definitions/com.github.openshift.api.operator.v1.AWSSubnets"
4156141569
}
4156241570
}
4156341571
},
41572+
"com.github.openshift.api.operator.v1.AWSProxyProtocol": {
41573+
"description": "AWSProxyProtocol contains configuration for enabling PROXY protocol on an AWS Network Load Balancer.",
41574+
"type": "object",
41575+
"required": [
41576+
"enabled"
41577+
],
41578+
"properties": {
41579+
"enabled": {
41580+
"description": "enabled specifies whether PROXY protocol should be enabled on the Network Load Balancer's target groups.\n\nWhen set to true, the NLB target group will have PROXY protocol v2 enabled and client IP preservation disabled. This allows backends to receive the original client IP via the PROXY protocol header while avoiding hairpin connection failures that can occur with client IP preservation on internal load balancers.\n\nWhen set to false or when the proxyProtocol field is omitted, client IP preservation remains enabled (the default NLB behavior).",
41581+
"type": "boolean",
41582+
"default": false
41583+
}
41584+
}
41585+
},
4156441586
"com.github.openshift.api.operator.v1.AWSSubnets": {
4156541587
"description": "AWSSubnets contains a list of references to AWS subnets by ID or name.",
4156641588
"type": "object",

‎operator/v1/types_ingress.go‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -898,8 +898,45 @@ type AWSNetworkLoadBalancerParameters struct {
898898
// +kubebuilder:validation:XValidation:rule=`self.all(x, self.exists_one(y, x == y))`,message="eipAllocations cannot contain duplicates"
899899
// +kubebuilder:validation:MaxItems=10
900900
EIPAllocations []EIPAllocation `json:"eipAllocations"`
901+
902+
// clientIPPreservationMode specifies how client IP addresses are
903+
// preserved by the load balancer.
904+
//
905+
// Valid values are "Native" and "ProxyProtocol".
906+
//
907+
// When set to "Native", the NLB uses AWS's native client IP preservation,
908+
// which may cause hairpin connection failures for internal load balancers when
909+
// connections are made from pods to router pods on the same node.
910+
//
911+
// When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
912+
// client IP addresses. This avoids hairpin connection failures.
913+
//
914+
// When omitted, the default behavior is "Native".
915+
//
916+
// Note that changing this field may cause brief connection failures during
917+
// the transition as the NLB attribute change and router rollout occur
918+
// independently.
919+
//
920+
// +optional
921+
ClientIPPreservationMode ClientIPPreservationMode `json:"clientIPPreservationMode,omitempty"`
901922
}
902923

924+
// ClientIPPreservationMode specifies how client IP addresses should be
925+
// preserved by the Network Load Balancer.
926+
// +kubebuilder:validation:Enum=Native;ProxyProtocol
927+
type ClientIPPreservationMode string
928+
929+
const (
930+
// ClientIPPreservationNative uses AWS's native client IP preservation,
931+
// which may cause hairpin connection failures for internal load balancers when
932+
// connections are made from pods to router pods on the same node.
933+
ClientIPPreservationNative ClientIPPreservationMode = "Native"
934+
935+
// ClientIPPreservationProxyProtocol uses PROXY protocol v2 to preserve
936+
// client IP addresses. This avoids hairpin connection failures.
937+
ClientIPPreservationProxyProtocol ClientIPPreservationMode = "ProxyProtocol"
938+
)
939+
903940
// EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment.
904941
// Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters.
905942
// + Explanation of the regex `^eipalloc-[0-9a-fA-F]{17}$` for validating value of the EIPAllocation:

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,29 @@ spec:
477477
networkLoadBalancerParameters holds configuration parameters for an AWS
478478
network load balancer. Present only if type is NLB.
479479
properties:
480+
clientIPPreservationMode:
481+
description: |-
482+
clientIPPreservationMode specifies how client IP addresses are
483+
preserved by the load balancer.
484+
485+
Valid values are "Native" and "ProxyProtocol".
486+
487+
When set to "Native", the NLB uses AWS's native client IP preservation,
488+
which may cause hairpin connection failures for internal load balancers when
489+
connections are made from pods to router pods on the same node.
490+
491+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
492+
client IP addresses. This avoids hairpin connection failures.
493+
494+
When omitted, the default behavior is "Native".
495+
496+
Note that changing this field may cause brief connection failures during
497+
the transition as the NLB attribute change and router rollout occur
498+
independently.
499+
enum:
500+
- Native
501+
- ProxyProtocol
502+
type: string
480503
eipAllocations:
481504
description: |-
482505
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
@@ -2749,6 +2772,29 @@ spec:
27492772
networkLoadBalancerParameters holds configuration parameters for an AWS
27502773
network load balancer. Present only if type is NLB.
27512774
properties:
2775+
clientIPPreservationMode:
2776+
description: |-
2777+
clientIPPreservationMode specifies how client IP addresses are
2778+
preserved by the load balancer.
2779+
2780+
Valid values are "Native" and "ProxyProtocol".
2781+
2782+
When set to "Native", the NLB uses AWS's native client IP preservation,
2783+
which may cause hairpin connection failures for internal load balancers when
2784+
connections are made from pods to router pods on the same node.
2785+
2786+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
2787+
client IP addresses. This avoids hairpin connection failures.
2788+
2789+
When omitted, the default behavior is "Native".
2790+
2791+
Note that changing this field may cause brief connection failures during
2792+
the transition as the NLB attribute change and router rollout occur
2793+
independently.
2794+
enum:
2795+
- Native
2796+
- ProxyProtocol
2797+
type: string
27522798
eipAllocations:
27532799
description: |-
27542800
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,29 @@ spec:
477477
networkLoadBalancerParameters holds configuration parameters for an AWS
478478
network load balancer. Present only if type is NLB.
479479
properties:
480+
clientIPPreservationMode:
481+
description: |-
482+
clientIPPreservationMode specifies how client IP addresses are
483+
preserved by the load balancer.
484+
485+
Valid values are "Native" and "ProxyProtocol".
486+
487+
When set to "Native", the NLB uses AWS's native client IP preservation,
488+
which may cause hairpin connection failures for internal load balancers when
489+
connections are made from pods to router pods on the same node.
490+
491+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
492+
client IP addresses. This avoids hairpin connection failures.
493+
494+
When omitted, the default behavior is "Native".
495+
496+
Note that changing this field may cause brief connection failures during
497+
the transition as the NLB attribute change and router rollout occur
498+
independently.
499+
enum:
500+
- Native
501+
- ProxyProtocol
502+
type: string
480503
eipAllocations:
481504
description: |-
482505
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
@@ -2718,6 +2741,29 @@ spec:
27182741
networkLoadBalancerParameters holds configuration parameters for an AWS
27192742
network load balancer. Present only if type is NLB.
27202743
properties:
2744+
clientIPPreservationMode:
2745+
description: |-
2746+
clientIPPreservationMode specifies how client IP addresses are
2747+
preserved by the load balancer.
2748+
2749+
Valid values are "Native" and "ProxyProtocol".
2750+
2751+
When set to "Native", the NLB uses AWS's native client IP preservation,
2752+
which may cause hairpin connection failures for internal load balancers when
2753+
connections are made from pods to router pods on the same node.
2754+
2755+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
2756+
client IP addresses. This avoids hairpin connection failures.
2757+
2758+
When omitted, the default behavior is "Native".
2759+
2760+
Note that changing this field may cause brief connection failures during
2761+
the transition as the NLB attribute change and router rollout occur
2762+
independently.
2763+
enum:
2764+
- Native
2765+
- ProxyProtocol
2766+
type: string
27212767
eipAllocations:
27222768
description: |-
27232769
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,29 @@ spec:
477477
networkLoadBalancerParameters holds configuration parameters for an AWS
478478
network load balancer. Present only if type is NLB.
479479
properties:
480+
clientIPPreservationMode:
481+
description: |-
482+
clientIPPreservationMode specifies how client IP addresses are
483+
preserved by the load balancer.
484+
485+
Valid values are "Native" and "ProxyProtocol".
486+
487+
When set to "Native", the NLB uses AWS's native client IP preservation,
488+
which may cause hairpin connection failures for internal load balancers when
489+
connections are made from pods to router pods on the same node.
490+
491+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
492+
client IP addresses. This avoids hairpin connection failures.
493+
494+
When omitted, the default behavior is "Native".
495+
496+
Note that changing this field may cause brief connection failures during
497+
the transition as the NLB attribute change and router rollout occur
498+
independently.
499+
enum:
500+
- Native
501+
- ProxyProtocol
502+
type: string
480503
eipAllocations:
481504
description: |-
482505
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
@@ -2749,6 +2772,29 @@ spec:
27492772
networkLoadBalancerParameters holds configuration parameters for an AWS
27502773
network load balancer. Present only if type is NLB.
27512774
properties:
2775+
clientIPPreservationMode:
2776+
description: |-
2777+
clientIPPreservationMode specifies how client IP addresses are
2778+
preserved by the load balancer.
2779+
2780+
Valid values are "Native" and "ProxyProtocol".
2781+
2782+
When set to "Native", the NLB uses AWS's native client IP preservation,
2783+
which may cause hairpin connection failures for internal load balancers when
2784+
connections are made from pods to router pods on the same node.
2785+
2786+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
2787+
client IP addresses. This avoids hairpin connection failures.
2788+
2789+
When omitted, the default behavior is "Native".
2790+
2791+
Note that changing this field may cause brief connection failures during
2792+
the transition as the NLB attribute change and router rollout occur
2793+
independently.
2794+
enum:
2795+
- Native
2796+
- ProxyProtocol
2797+
type: string
27522798
eipAllocations:
27532799
description: |-
27542800
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that

0 commit comments

Comments
 (0)