Configure Proxy Protocol for Istio Ingress

If you access applications through an Istio gateway on Managed - FPT Kubernetes Engine and need the real public IP of end users, configure Proxy Protocol as follows.

Enable Proxy Protocol

1. Add the annotation loadbalancer.fptcloud.com/proxy-protocol: "true" to the istio-ingressgateway service configuration.

2. Apply an EnvoyFilter in the istio-system namespace:

   apiVersion: networking.istio.io/v1alpha3
   kind: EnvoyFilter
   metadata:
     name: proxy-protocol
     namespace: istio-system
   spec:
     configPatches:
     - applyTo: LISTENER
       patch:
         operation: MERGE
         value:
           listener_filters:
           - name: envoy.filters.listener.proxy_protocol
             typed_config:
               '@type': type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
     workloadSelector:
       labels:
         istio: [lable-istio-gateway]

With this configuration, the istio-ingressgateway pod logs show the real source public IP of end users accessing the application through the gateway.

note

This guide applies to Istio open source versions 1.22 and earlier.