Skip to main content

Configure Proxy Protocol for Nginx Ingress

If you access applications through an Nginx ingress gateway on Managed - FPT Kubernetes Engine and need the real public IP of end users, configure Proxy Protocol as follows.

Enable Proxy Protocol​

  1. Add the annotation loadbalancer.fptcloud.com/proxy-protocol: "true" to the nginx-ingress-controller service configuration.

  2. Add the following fields to the nginx-ingress-controller ConfigMap, in the namespace where you deployed the Nginx ingress controller:

    allow-snippet-annotations: "true"
    proxy-protocol: "True"
    real-ip-header: proxy_protocol
    use-proxy-protocol: "true"

  3. Restart the Nginx ingress controller to apply the new ConfigMap.

If your application calls the ingress domain on port 443, also add this annotation to the Nginx ingress controller's LoadBalancer service:

loadbalancer.fptcloud.com/enable-ingress-hostname: "true"
note

With a LoadBalancer service using Proxy Protocol on an L4 LB, Pods inside the cluster can't reach the service through the ingress domain on port 443, even though external internet access still works. kube-proxy adds the LoadBalancer's public IP to iptables on the nodes and maps it to a worker-node interface, so in-cluster requests to the ingress domain get blocked at that interface. Configuring the ingress hostname (above) fixes this, so connectivity works both inside the cluster and from the internet.