Skip to content

Commit 5537c40

Browse files
arnaud-dezandeearnaud-dezandee
committed
feat: svc enable proxy protocol on specified ports
1 parent 31ec9f0 commit 5537c40

File tree

3 files changed

+81
-17
lines changed

3 files changed

+81
-17
lines changed

‎docs/guide/service/annotations.md

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
| [service.beta.kubernetes.io/aws-load-balancer-name](#load-balancer-name) | string | | |
2828
| [service.beta.kubernetes.io/aws-load-balancer-internal](#lb-internal) | boolean | false | deprecated, in favor of [aws-load-balancer-scheme](#lb-scheme) |
2929
| [service.beta.kubernetes.io/aws-load-balancer-scheme](#lb-scheme) | string | internal | |
30-
| [service.beta.kubernetes.io/aws-load-balancer-proxy-protocol](#proxy-protocol-v2) | string | | Set to `"*"` to enable |
30+
| [service.beta.kubernetes.io/aws-load-balancer-proxy-protocol](#proxy-protocol-v2) | string | | Set to `"*"` to enable for all service ports |
3131
| [service.beta.kubernetes.io/aws-load-balancer-proxy-protocol-per-target-group](#proxy-protocol-v2) | string | | If specified,configures proxy protocol for the target groups corresponding to the ports mentioned and disables for the rest. For example, if you have services deployed on ports `"80, 443 and 22"`, the annotation value `"80, 443"` will enable proxy protocol for ports 80 and 443 only, and disable for port 22. This annotation is overriden by `"service.beta.kubernetes.io/aws-load-balancer-proxy-protocol"` |
3232
| [service.beta.kubernetes.io/aws-load-balancer-ip-address-type](#ip-address-type) | string | ipv4 | ipv4 \| dualstack |
3333
| [service.beta.kubernetes.io/aws-load-balancer-access-log-enabled](#deprecated-attributes) | boolean | false | deprecated, in favor of [aws-load-balancer-attributes](#load-balancer-attributes) |
@@ -256,11 +256,18 @@ You can configure dualstack NLB to support UDP-based services over IPv6 via the
256256
NLB resource attributes can be controlled via the following annotations:
257257

258258
- <a name="proxy-protocol-v2">service.beta.kubernetes.io/aws-load-balancer-proxy-protocol</a> specifies whether to enable proxy protocol v2 on the target group.
259-
Set to '*' to enable proxy protocol v2. This annotation takes precedence over the annotation `service.beta.kubernetes.io/aws-load-balancer-target-group-attributes`
260-
for proxy protocol v2 configuration.
259+
This annotation takes precedence over the annotation `service.beta.kubernetes.io/aws-load-balancer-target-group-attributes` for proxy protocol v2 configuration.
260+
If you specify `*`, proxy protocol v2 is enabled for all ports. If you specify a list of one or more ports, proxy protocol v2 is enabled only for those ports.
261261

262-
!!!note ""
263-
The only valid value for this annotation is `*`.
262+
!!!example
263+
- enable proxy protocol for all ports
264+
```
265+
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: *
266+
```
267+
- enable proxy protocol for ports 80 and 443
268+
```
269+
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: 80, 443
270+
```
264271

265272
- <a name="target-group-attributes">`service.beta.kubernetes.io/aws-load-balancer-target-group-attributes`</a> specifies the
266273
[Target Group Attributes](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#target-group-attributes) to be configured.

‎pkg/service/model_build_target_group.go

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"encoding/hex"
77
"fmt"
88
"regexp"
9-
"sigs.k8s.io/aws-load-balancer-controller/pkg/shared_constants"
109
"sort"
1110
"strconv"
1211
"strings"
@@ -23,6 +22,7 @@ import (
2322
"sigs.k8s.io/aws-load-balancer-controller/pkg/k8s"
2423
elbv2model "sigs.k8s.io/aws-load-balancer-controller/pkg/model/elbv2"
2524
"sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
25+
"sigs.k8s.io/aws-load-balancer-controller/pkg/shared_constants"
2626
)
2727

2828
func (t *defaultModelBuildTask) buildTargetGroup(ctx context.Context, port corev1.ServicePort, tgProtocol elbv2model.Protocol, scheme elbv2model.LoadBalancerScheme) (*elbv2model.TargetGroup, error) {
@@ -233,12 +233,18 @@ func (t *defaultModelBuildTask) buildTargetGroupAttributes(_ context.Context, po
233233
}
234234
}
235235

236-
proxyV2Annotation := ""
237-
if exists := t.annotationParser.ParseStringAnnotation(annotations.SvcLBSuffixProxyProtocol, &proxyV2Annotation, t.service.Annotations); exists {
238-
if proxyV2Annotation != "*" {
239-
return []elbv2model.TargetGroupAttribute{}, errors.Errorf("invalid value %v for Load Balancer proxy protocol v2 annotation, only value currently supported is *", proxyV2Annotation)
236+
var proxyV2Annotations []string
237+
if exists := t.annotationParser.ParseStringSliceAnnotation(annotations.SvcLBSuffixProxyProtocol, &proxyV2Annotations, t.service.Annotations); exists {
238+
for _, proxySelector := range proxyV2Annotations {
239+
if proxySelector == "*" {
240+
rawAttributes[shared_constants.TGAttributeProxyProtocolV2Enabled] = "true"
241+
break
242+
}
243+
if proxySelector == strconv.Itoa(int(port.Port)) {
244+
rawAttributes[shared_constants.TGAttributeProxyProtocolV2Enabled] = "true"
245+
break
246+
}
240247
}
241-
rawAttributes[shared_constants.TGAttributeProxyProtocolV2Enabled] = "true"
242248
}
243249

244250
if rawPreserveIPEnabled, ok := rawAttributes[shared_constants.TGAttributePreserveClientIPEnabled]; ok {

‎pkg/service/model_build_target_group_test.go

Lines changed: 57 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,24 @@ package service
33
import (
44
"context"
55
"errors"
6-
"sigs.k8s.io/aws-load-balancer-controller/pkg/shared_constants"
76
"sort"
87
"strconv"
98
"testing"
109

1110
"github.com/aws/aws-sdk-go-v2/aws"
1211
ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
1312
"github.com/golang/mock/gomock"
14-
"sigs.k8s.io/aws-load-balancer-controller/pkg/model/core"
15-
"sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
16-
1713
"github.com/stretchr/testify/assert"
1814
corev1 "k8s.io/api/core/v1"
1915
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2016
"k8s.io/apimachinery/pkg/util/intstr"
2117
elbv2api "sigs.k8s.io/aws-load-balancer-controller/apis/elbv2/v1beta1"
2218
"sigs.k8s.io/aws-load-balancer-controller/pkg/annotations"
2319
"sigs.k8s.io/aws-load-balancer-controller/pkg/config"
20+
"sigs.k8s.io/aws-load-balancer-controller/pkg/model/core"
2421
"sigs.k8s.io/aws-load-balancer-controller/pkg/model/elbv2"
22+
"sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
23+
"sigs.k8s.io/aws-load-balancer-controller/pkg/shared_constants"
2524
)
2625

2726
func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
@@ -65,15 +64,67 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
6564
},
6665
},
6766
{
68-
testName: "Invalid value",
67+
testName: "no matching value",
6968
svc: &corev1.Service{
7069
ObjectMeta: metav1.ObjectMeta{
7170
Annotations: map[string]string{
7271
"service.beta.kubernetes.io/aws-load-balancer-proxy-protocol": "v2",
7372
},
7473
},
7574
},
76-
wantError: true,
75+
wantValue: []elbv2.TargetGroupAttribute{
76+
{
77+
Key: shared_constants.TGAttributeProxyProtocolV2Enabled,
78+
Value: "false",
79+
},
80+
},
81+
wantError: false,
82+
},
83+
{
84+
testName: "matching value",
85+
svc: &corev1.Service{
86+
ObjectMeta: metav1.ObjectMeta{
87+
Annotations: map[string]string{
88+
"service.beta.kubernetes.io/aws-load-balancer-proxy-protocol": "80",
89+
},
90+
},
91+
},
92+
port: corev1.ServicePort{
93+
Name: "http",
94+
Port: 80,
95+
TargetPort: intstr.FromInt(8080),
96+
NodePort: 32768,
97+
},
98+
wantValue: []elbv2.TargetGroupAttribute{
99+
{
100+
Key: shared_constants.TGAttributeProxyProtocolV2Enabled,
101+
Value: "true",
102+
},
103+
},
104+
wantError: false,
105+
},
106+
{
107+
testName: "multiple values",
108+
svc: &corev1.Service{
109+
ObjectMeta: metav1.ObjectMeta{
110+
Annotations: map[string]string{
111+
"service.beta.kubernetes.io/aws-load-balancer-proxy-protocol": "443, 80, 9090",
112+
},
113+
},
114+
},
115+
port: corev1.ServicePort{
116+
Name: "http",
117+
Port: 80,
118+
TargetPort: intstr.FromInt(8080),
119+
NodePort: 32768,
120+
},
121+
wantValue: []elbv2.TargetGroupAttribute{
122+
{
123+
Key: shared_constants.TGAttributeProxyProtocolV2Enabled,
124+
Value: "true",
125+
},
126+
},
127+
wantError: false,
77128
},
78129
{
79130
testName: "target group attributes",

0 commit comments

Comments
 (0)