Skip to content

Commit b27f43f

Browse files
gcs278gcs278
committed
OCPBUGS-63219: Add clientIPPreservationMode to AWS NLB parameters
Add clientIPPreservationMode field to AWSNetworkLoadBalancerParameters to control how client IP addresses are preserved. The field accepts "Preserved" (uses AWS's native client IP preservation, the default) and "ProxyProtocol" (uses PROXY protocol v2). When set to Preserved, the NLB target group has preserve_client_ip.enabled set to true, which may cause hairpin connection failures for internal load balancers when connections are made from pods to router pods on the same node. When set to ProxyProtocol, the NLB target group has preserve_client_ip.enabled set to false and proxy_protocol_v2.enabled set to true. This allows backends to receive the original client IP via PROXY protocol headers while avoiding hairpin connection failures.
1 parent 6fb7fda commit b27f43f

6 files changed

Lines changed: 166 additions & 3 deletions

File tree

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24706,6 +24706,10 @@
2470624706
"format": "int32",
2470724707
"default": 0
2470824708
},
24709+
"synchronizedAPI": {
24710+
"description": "synchronizedAPI holds the last stable value of authoritativeAPI. It is used to detect migration cancellation requests and to restore the resource to its previous state. Valid values are \"MachineAPI\" and \"ClusterAPI\". When omitted, the resource has not yet been reconciled by the migration controller.",
24711+
"type": "string"
24712+
},
2470924713
"synchronizedGeneration": {
2471024714
"description": "synchronizedGeneration is the generation of the authoritative resource that the non-authoritative resource is synchronised with. This field is set when the authoritative resource is updated and the sync controller has updated the non-authoritative resource to match.",
2471124715
"type": "integer",
@@ -24809,6 +24813,10 @@
2480924813
"description": "providerStatus details a Provider-specific status. It is recommended that providers maintain their own versioned API types that should be serialized/deserialized from this field.",
2481024814
"$ref": "#/definitions/io.k8s.apimachinery.pkg.runtime.RawExtension"
2481124815
},
24816+
"synchronizedAPI": {
24817+
"description": "synchronizedAPI holds the last stable value of authoritativeAPI. It is used to detect migration cancellation requests and to restore the resource to its previous state. Valid values are \"MachineAPI\" and \"ClusterAPI\". When omitted, the resource has not yet been reconciled by the migration controller.",
24818+
"type": "string"
24819+
},
2481224820
"synchronizedGeneration": {
2481324821
"description": "synchronizedGeneration is the generation of the authoritative resource that the non-authoritative resource is synchronised with. This field is set when the authoritative resource is updated and the sync controller has updated the non-authoritative resource to match.",
2481424822
"type": "integer",
@@ -28387,12 +28395,30 @@
2838728395
},
2838828396
"x-kubernetes-list-type": "atomic"
2838928397
},
28398+
"proxyProtocol": {
28399+
"description": "proxyProtocol enables PROXY protocol on the Network Load Balancer's target groups.\n\nWhen enabled, the NLB will prepend a PROXY protocol header to each TCP connection that contains the original source and destination IP addresses and ports. This allows the backend to see the true client IP address while preserving the ability to handle hairpin connections (connections from pods to a service that targets those same pods).\n\nWhen enabled, the NLB target group attribute `preserve_client_ip.enabled` is set to false and `proxy_protocol_v2.enabled` is set to true. Application backends must be configured to parse the PROXY protocol header to extract the original client IP address.\n\nWhen this field is not set or set to false, client IP preservation is enabled (the default AWS NLB behavior), which may cause hairpin connection failures for internal load balancers.\n\nSee https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocol for more information about PROXY protocol support on AWS Network Load Balancers.",
28400+
"$ref": "#/definitions/com.github.openshift.api.operator.v1.AWSProxyProtocol"
28401+
},
2839028402
"subnets": {
2839128403
"description": "subnets specifies the subnets to which the load balancer will attach. The subnets may be specified by either their ID or name. The total number of subnets is limited to 10.\n\nIn order for the load balancer to be provisioned with subnets, each subnet must exist, each subnet must be from a different availability zone, and the load balancer service must be recreated to pick up new values.\n\nWhen omitted from the spec, the subnets will be auto-discovered for each availability zone. Auto-discovered subnets are not reported in the status of the IngressController object.",
2839228404
"$ref": "#/definitions/com.github.openshift.api.operator.v1.AWSSubnets"
2839328405
}
2839428406
}
2839528407
},
28408+
"com.github.openshift.api.operator.v1.AWSProxyProtocol": {
28409+
"description": "AWSProxyProtocol contains configuration for enabling PROXY protocol on an AWS Network Load Balancer.",
28410+
"type": "object",
28411+
"required": [
28412+
"enabled"
28413+
],
28414+
"properties": {
28415+
"enabled": {
28416+
"description": "enabled specifies whether PROXY protocol should be enabled on the Network Load Balancer's target groups.\n\nWhen set to true, the NLB target group will have PROXY protocol v2 enabled and client IP preservation disabled. This allows backends to receive the original client IP via the PROXY protocol header while avoiding hairpin connection failures that can occur with client IP preservation on internal load balancers.\n\nWhen set to false or when the proxyProtocol field is omitted, client IP preservation remains enabled (the default NLB behavior).",
28417+
"type": "boolean",
28418+
"default": false
28419+
}
28420+
}
28421+
},
2839628422
"com.github.openshift.api.operator.v1.AWSSubnets": {
2839728423
"description": "AWSSubnets contains a list of references to AWS subnets by ID or name.",
2839828424
"type": "object",

‎operator/v1/types_ingress.go‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -898,8 +898,45 @@ type AWSNetworkLoadBalancerParameters struct {
898898
// +kubebuilder:validation:XValidation:rule=`self.all(x, self.exists_one(y, x == y))`,message="eipAllocations cannot contain duplicates"
899899
// +kubebuilder:validation:MaxItems=10
900900
EIPAllocations []EIPAllocation `json:"eipAllocations"`
901+
902+
// clientIPPreservationMode specifies how client IP addresses are
903+
// preserved by the load balancer.
904+
//
905+
// Valid values are "Preserved" and "ProxyProtocol".
906+
//
907+
// When set to "Preserved", the NLB uses AWS's native client IP preservation,
908+
// which may cause hairpin connection failures for internal load balancers when
909+
// connections are made from pods to router pods on the same node.
910+
//
911+
// When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
912+
// client IP addresses. This avoids hairpin connection failures.
913+
//
914+
// When omitted, the default behavior is "Preserved".
915+
//
916+
// Note that changing this field may cause brief connection failures during
917+
// the transition as the NLB attribute change and router rollout occur
918+
// independently.
919+
//
920+
// +optional
921+
ClientIPPreservationMode ClientIPPreservationMode `json:"clientIPPreservationMode,omitempty"`
901922
}
902923

924+
// ClientIPPreservationMode specifies how client IP addresses should be
925+
// preserved by the Network Load Balancer.
926+
// +kubebuilder:validation:Enum=Preserved;ProxyProtocol
927+
type ClientIPPreservationMode string
928+
929+
const (
930+
// ClientIPPreservationPreserved uses AWS's native client IP preservation,
931+
// which may cause hairpin connection failures for internal load balancers when
932+
// connections are made from pods to router pods on the same node.
933+
ClientIPPreservationPreserved ClientIPPreservationMode = "Preserved"
934+
935+
// ClientIPPreservationProxyProtocol uses PROXY protocol v2 to preserve
936+
// client IP addresses. This avoids hairpin connection failures.
937+
ClientIPPreservationProxyProtocol ClientIPPreservationMode = "ProxyProtocol"
938+
)
939+
903940
// EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment.
904941
// Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters.
905942
// + Explanation of the regex `^eipalloc-[0-9a-fA-F]{17}$` for validating value of the EIPAllocation:

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers.crd.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -476,6 +476,29 @@ spec:
476476
networkLoadBalancerParameters holds configuration parameters for an AWS
477477
network load balancer. Present only if type is NLB.
478478
properties:
479+
clientIPPreservationMode:
480+
description: |-
481+
clientIPPreservationMode specifies how client IP addresses are
482+
preserved by the load balancer.
483+
484+
Valid values are "Preserved" and "ProxyProtocol".
485+
486+
When set to "Preserved", the NLB uses AWS's native client IP preservation,
487+
which may cause hairpin connection failures for internal load balancers when
488+
connections are made from pods to router pods on the same node.
489+
490+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
491+
client IP addresses. This avoids hairpin connection failures.
492+
493+
When omitted, the default behavior is "Preserved".
494+
495+
Note that changing this field may cause brief connection failures during
496+
the transition as the NLB attribute change and router rollout occur
497+
independently.
498+
enum:
499+
- Preserved
500+
- ProxyProtocol
501+
type: string
479502
eipAllocations:
480503
description: |-
481504
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
@@ -2728,6 +2751,29 @@ spec:
27282751
networkLoadBalancerParameters holds configuration parameters for an AWS
27292752
network load balancer. Present only if type is NLB.
27302753
properties:
2754+
clientIPPreservationMode:
2755+
description: |-
2756+
clientIPPreservationMode specifies how client IP addresses are
2757+
preserved by the load balancer.
2758+
2759+
Valid values are "Preserved" and "ProxyProtocol".
2760+
2761+
When set to "Preserved", the NLB uses AWS's native client IP preservation,
2762+
which may cause hairpin connection failures for internal load balancers when
2763+
connections are made from pods to router pods on the same node.
2764+
2765+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
2766+
client IP addresses. This avoids hairpin connection failures.
2767+
2768+
When omitted, the default behavior is "Preserved".
2769+
2770+
Note that changing this field may cause brief connection failures during
2771+
the transition as the NLB attribute change and router rollout occur
2772+
independently.
2773+
enum:
2774+
- Preserved
2775+
- ProxyProtocol
2776+
type: string
27312777
eipAllocations:
27322778
description: |-
27332779
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that

‎operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,29 @@ spec:
477477
networkLoadBalancerParameters holds configuration parameters for an AWS
478478
network load balancer. Present only if type is NLB.
479479
properties:
480+
clientIPPreservationMode:
481+
description: |-
482+
clientIPPreservationMode specifies how client IP addresses are
483+
preserved by the load balancer.
484+
485+
Valid values are "Preserved" and "ProxyProtocol".
486+
487+
When set to "Preserved", the NLB uses AWS's native client IP preservation,
488+
which may cause hairpin connection failures for internal load balancers when
489+
connections are made from pods to router pods on the same node.
490+
491+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
492+
client IP addresses. This avoids hairpin connection failures.
493+
494+
When omitted, the default behavior is "Preserved".
495+
496+
Note that changing this field may cause brief connection failures during
497+
the transition as the NLB attribute change and router rollout occur
498+
independently.
499+
enum:
500+
- Preserved
501+
- ProxyProtocol
502+
type: string
480503
eipAllocations:
481504
description: |-
482505
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
@@ -2711,6 +2734,29 @@ spec:
27112734
networkLoadBalancerParameters holds configuration parameters for an AWS
27122735
network load balancer. Present only if type is NLB.
27132736
properties:
2737+
clientIPPreservationMode:
2738+
description: |-
2739+
clientIPPreservationMode specifies how client IP addresses are
2740+
preserved by the load balancer.
2741+
2742+
Valid values are "Preserved" and "ProxyProtocol".
2743+
2744+
When set to "Preserved", the NLB uses AWS's native client IP preservation,
2745+
which may cause hairpin connection failures for internal load balancers when
2746+
connections are made from pods to router pods on the same node.
2747+
2748+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
2749+
client IP addresses. This avoids hairpin connection failures.
2750+
2751+
When omitted, the default behavior is "Preserved".
2752+
2753+
Note that changing this field may cause brief connection failures during
2754+
the transition as the NLB attribute change and router rollout occur
2755+
independently.
2756+
enum:
2757+
- Preserved
2758+
- ProxyProtocol
2759+
type: string
27142760
eipAllocations:
27152761
description: |-
27162762
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that

‎operator/v1/zz_generated.swagger_doc_generated.go‎

Lines changed: 4 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)