Skip to content

Commit e6b120a

Browse files
gcs278gcs278
committed
OCPBUGS-63219: Add clientIPPreservationMode to AWS NLB parameters
Add clientIPPreservationMode field to AWSNetworkLoadBalancerParameters to control how client IP addresses are preserved. The field accepts "Native" (uses AWS's native client IP preservation) and "ProxyProtocol" (uses PROXY protocol v2, the new default). When set to Native, the NLB target group has preserve_client_ip.enabled set to true, which may cause hairpin connection failures for internal load balancers when connections are made from pods to router pods on the same node. When set to ProxyProtocol, the NLB target group has preserve_client_ip.enabled set to false and proxy_protocol_v2.enabled set to true. This allows backends to receive the original client IP via PROXY protocol headers while avoiding hairpin connection failures.
1 parent 4f63a40 commit e6b120a

11 files changed

Lines changed: 422 additions & 3 deletions

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38292,6 +38292,10 @@
3829238292
"description": "synchronizedAPI holds the last stable value of authoritativeAPI. It is used to detect migration cancellation requests and to restore the resource to its previous state. Valid values are \"MachineAPI\" and \"ClusterAPI\". When omitted, the resource has not yet been reconciled by the migration controller.",
3829338293
"type": "string"
3829438294
},
38295+
"synchronizedAPI": {
38296+
"description": "synchronizedAPI holds the last stable value of authoritativeAPI. It is used to detect migration cancellation requests and to restore the resource to its previous state. Valid values are \"MachineAPI\" and \"ClusterAPI\". When omitted, the resource has not yet been reconciled by the migration controller.",
38297+
"type": "string"
38298+
},
3829538299
"synchronizedGeneration": {
3829638300
"description": "synchronizedGeneration is the generation of the authoritative resource that the non-authoritative resource is synchronised with. This field is set when the authoritative resource is updated and the sync controller has updated the non-authoritative resource to match.",
3829738301
"type": "integer",
@@ -41555,12 +41559,30 @@
4155541559
},
4155641560
"x-kubernetes-list-type": "atomic"
4155741561
},
41562+
"proxyProtocol": {
41563+
"description": "proxyProtocol enables PROXY protocol on the Network Load Balancer's target groups.\n\nWhen enabled, the NLB will prepend a PROXY protocol header to each TCP connection that contains the original source and destination IP addresses and ports. This allows the backend to see the true client IP address while preserving the ability to handle hairpin connections (connections from pods to a service that targets those same pods).\n\nWhen enabled, the NLB target group attribute `preserve_client_ip.enabled` is set to false and `proxy_protocol_v2.enabled` is set to true. Application backends must be configured to parse the PROXY protocol header to extract the original client IP address.\n\nWhen this field is not set or set to false, client IP preservation is enabled (the default AWS NLB behavior), which may cause hairpin connection failures for internal load balancers.\n\nSee https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocol for more information about PROXY protocol support on AWS Network Load Balancers.",
41564+
"$ref": "#/definitions/com.github.openshift.api.operator.v1.AWSProxyProtocol"
41565+
},
4155841566
"subnets": {
4155941567
"description": "subnets specifies the subnets to which the load balancer will attach. The subnets may be specified by either their ID or name. The total number of subnets is limited to 10.\n\nIn order for the load balancer to be provisioned with subnets, each subnet must exist, each subnet must be from a different availability zone, and the load balancer service must be recreated to pick up new values.\n\nWhen omitted from the spec, the subnets will be auto-discovered for each availability zone. Auto-discovered subnets are not reported in the status of the IngressController object.",
4156041568
"$ref": "#/definitions/com.github.openshift.api.operator.v1.AWSSubnets"
4156141569
}
4156241570
}
4156341571
},
41572+
"com.github.openshift.api.operator.v1.AWSProxyProtocol": {
41573+
"description": "AWSProxyProtocol contains configuration for enabling PROXY protocol on an AWS Network Load Balancer.",
41574+
"type": "object",
41575+
"required": [
41576+
"enabled"
41577+
],
41578+
"properties": {
41579+
"enabled": {
41580+
"description": "enabled specifies whether PROXY protocol should be enabled on the Network Load Balancer's target groups.\n\nWhen set to true, the NLB target group will have PROXY protocol v2 enabled and client IP preservation disabled. This allows backends to receive the original client IP via the PROXY protocol header while avoiding hairpin connection failures that can occur with client IP preservation on internal load balancers.\n\nWhen set to false or when the proxyProtocol field is omitted, client IP preservation remains enabled (the default NLB behavior).",
41581+
"type": "boolean",
41582+
"default": false
41583+
}
41584+
}
41585+
},
4156441586
"com.github.openshift.api.operator.v1.AWSSubnets": {
4156541587
"description": "AWSSubnets contains a list of references to AWS subnets by ID or name.",
4156641588
"type": "object",

‎operator/v1/types_ingress.go‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -898,8 +898,47 @@ type AWSNetworkLoadBalancerParameters struct {
898898
// +kubebuilder:validation:XValidation:rule=`self.all(x, self.exists_one(y, x == y))`,message="eipAllocations cannot contain duplicates"
899899
// +kubebuilder:validation:MaxItems=10
900900
EIPAllocations []EIPAllocation `json:"eipAllocations"`
901+
902+
// clientIPPreservationMode specifies how client IP addresses are
903+
// preserved by the load balancer.
904+
//
905+
// Valid values are "Native" and "ProxyProtocol".
906+
//
907+
// When set to "Native", the NLB uses AWS's native client IP preservation,
908+
// which may cause hairpin connection failures for internal load balancers when
909+
// connections are made from pods to router pods on the same node.
910+
//
911+
// When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
912+
// client IP addresses. This avoids hairpin connection failures.
913+
//
914+
// When omitted, this means the user has no opinion and the value is left
915+
// to the platform to choose a good default, which is subject to change
916+
// over time. The current default is "ProxyProtocol".
917+
//
918+
// Note that changing this field may cause brief connection failures during
919+
// the transition as the NLB attribute change and router rollout occur
920+
// independently.
921+
//
922+
// +optional
923+
ClientIPPreservationMode ClientIPPreservationMode `json:"clientIPPreservationMode,omitempty"`
901924
}
902925

926+
// ClientIPPreservationMode specifies how client IP addresses should be
927+
// preserved by the Network Load Balancer.
928+
// +kubebuilder:validation:Enum=Native;ProxyProtocol
929+
type ClientIPPreservationMode string
930+
931+
const (
932+
// ClientIPPreservationNative uses AWS's native client IP preservation,
933+
// which may cause hairpin connection failures for internal load balancers when
934+
// connections are made from pods to router pods on the same node.
935+
ClientIPPreservationNative ClientIPPreservationMode = "Native"
936+
937+
// ClientIPPreservationProxyProtocol uses PROXY protocol v2 to preserve
938+
// client IP addresses. This avoids hairpin connection failures.
939+
ClientIPPreservationProxyProtocol ClientIPPreservationMode = "ProxyProtocol"
940+
)
941+
903942
// EIPAllocation is an ID for an Elastic IP (EIP) address that can be allocated to an ELB in the AWS environment.
904943
// Values must begin with `eipalloc-` followed by exactly 17 hexadecimal (`[0-9a-fA-F]`) characters.
905944
// + Explanation of the regex `^eipalloc-[0-9a-fA-F]{17}$` for validating value of the EIPAllocation:

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,31 @@ spec:
477477
networkLoadBalancerParameters holds configuration parameters for an AWS
478478
network load balancer. Present only if type is NLB.
479479
properties:
480+
clientIPPreservationMode:
481+
description: |-
482+
clientIPPreservationMode specifies how client IP addresses are
483+
preserved by the load balancer.
484+
485+
Valid values are "Native" and "ProxyProtocol".
486+
487+
When set to "Native", the NLB uses AWS's native client IP preservation,
488+
which may cause hairpin connection failures for internal load balancers when
489+
connections are made from pods to router pods on the same node.
490+
491+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
492+
client IP addresses. This avoids hairpin connection failures.
493+
494+
When omitted, this means the user has no opinion and the value is left
495+
to the platform to choose a good default, which is subject to change
496+
over time. The current default is "ProxyProtocol".
497+
498+
Note that changing this field may cause brief connection failures during
499+
the transition as the NLB attribute change and router rollout occur
500+
independently.
501+
enum:
502+
- Native
503+
- ProxyProtocol
504+
type: string
480505
eipAllocations:
481506
description: |-
482507
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
@@ -2749,6 +2774,31 @@ spec:
27492774
networkLoadBalancerParameters holds configuration parameters for an AWS
27502775
network load balancer. Present only if type is NLB.
27512776
properties:
2777+
clientIPPreservationMode:
2778+
description: |-
2779+
clientIPPreservationMode specifies how client IP addresses are
2780+
preserved by the load balancer.
2781+
2782+
Valid values are "Native" and "ProxyProtocol".
2783+
2784+
When set to "Native", the NLB uses AWS's native client IP preservation,
2785+
which may cause hairpin connection failures for internal load balancers when
2786+
connections are made from pods to router pods on the same node.
2787+
2788+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
2789+
client IP addresses. This avoids hairpin connection failures.
2790+
2791+
When omitted, this means the user has no opinion and the value is left
2792+
to the platform to choose a good default, which is subject to change
2793+
over time. The current default is "ProxyProtocol".
2794+
2795+
Note that changing this field may cause brief connection failures during
2796+
the transition as the NLB attribute change and router rollout occur
2797+
independently.
2798+
enum:
2799+
- Native
2800+
- ProxyProtocol
2801+
type: string
27522802
eipAllocations:
27532803
description: |-
27542804
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,31 @@ spec:
477477
networkLoadBalancerParameters holds configuration parameters for an AWS
478478
network load balancer. Present only if type is NLB.
479479
properties:
480+
clientIPPreservationMode:
481+
description: |-
482+
clientIPPreservationMode specifies how client IP addresses are
483+
preserved by the load balancer.
484+
485+
Valid values are "Native" and "ProxyProtocol".
486+
487+
When set to "Native", the NLB uses AWS's native client IP preservation,
488+
which may cause hairpin connection failures for internal load balancers when
489+
connections are made from pods to router pods on the same node.
490+
491+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
492+
client IP addresses. This avoids hairpin connection failures.
493+
494+
When omitted, this means the user has no opinion and the value is left
495+
to the platform to choose a good default, which is subject to change
496+
over time. The current default is "ProxyProtocol".
497+
498+
Note that changing this field may cause brief connection failures during
499+
the transition as the NLB attribute change and router rollout occur
500+
independently.
501+
enum:
502+
- Native
503+
- ProxyProtocol
504+
type: string
480505
eipAllocations:
481506
description: |-
482507
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that
@@ -2718,6 +2743,31 @@ spec:
27182743
networkLoadBalancerParameters holds configuration parameters for an AWS
27192744
network load balancer. Present only if type is NLB.
27202745
properties:
2746+
clientIPPreservationMode:
2747+
description: |-
2748+
clientIPPreservationMode specifies how client IP addresses are
2749+
preserved by the load balancer.
2750+
2751+
Valid values are "Native" and "ProxyProtocol".
2752+
2753+
When set to "Native", the NLB uses AWS's native client IP preservation,
2754+
which may cause hairpin connection failures for internal load balancers when
2755+
connections are made from pods to router pods on the same node.
2756+
2757+
When set to "ProxyProtocol", the NLB uses PROXY protocol v2 to preserve
2758+
client IP addresses. This avoids hairpin connection failures.
2759+
2760+
When omitted, this means the user has no opinion and the value is left
2761+
to the platform to choose a good default, which is subject to change
2762+
over time. The current default is "ProxyProtocol".
2763+
2764+
Note that changing this field may cause brief connection failures during
2765+
the transition as the NLB attribute change and router rollout occur
2766+
independently.
2767+
enum:
2768+
- Native
2769+
- ProxyProtocol
2770+
type: string
27212771
eipAllocations:
27222772
description: |-
27232773
eipAllocations is a list of IDs for Elastic IP (EIP) addresses that

0 commit comments

Comments
 (0)