Is proxy protocol supported?

[choerl-sys11]

Hi everyone,

I am digging deeper into Kubernetes Gateway API these days and chose the Nginx Gateway Fabric (ngf) implementation since I know ingress-nginx quite well.

Question:
Is it possible to receive the proxy protocol?

I already found this discussion but the outcome for my question is not clear to me: #708

Setup:
I deployed it as a helm chart from here:
https://github.com/nginxinc/nginx-gateway-fabric/tree/main/deploy/helm-chart

Everything works fine so far but I am missing the feature of enabling (receiving) proxy protocol in ngf.
My infrastructure is behind an Openstack Octavia loadbalancer which offers to preserve the original client IP address only when proxy protocol is enabled.

ngf is capable of using the annotation loadbalancer.openstack.org/proxy-protocol: "true" in its loadbalancer service.
This tells Ocatavia loadbalancer to enable it and send incoming requests with the proxy protocol information attached to the receiving nginx proxy (in this case ngf).

Problem:
Sadly for me ngf does not seem to receive the proxy protocol information correctly, so each incoming requests outputs in the log:

$ kubectl logs -f pods/ngf-nginx-gateway-fabric-84979f8cf5-n4ftr -c nginx

ngf-nginx-gateway-fabric-84979f8cf5-n4ftr nginx 2023/12/18 08:20:57 [info] 98#98: *189 client sent invalid request while reading client request line, client: 172.25.0.0, server: , request: "PROXY TCP4 <MY-PUBLIC-CLIENT-IP> 192.168.85.10 35456 80"

ngf-nginx-gateway-fabric-84979f8cf5-n4ftr nginx 172.25.3.0 - - [18/Dec/2023:08:20:57 +0000] "PROXY TCP4 <MY-PUBLIC-CLIENT-IP> 192.168.85.10 35440 80" 400 157 "-" "-"

And of course a published web service displays an HTML page of:

400 Bad Request
nginx/1.25.3

Conclusion:
So I am missing a feature of instructing ngf to receive the proxy protocol like ingress-nginx did by this helm value setting: controller.config.use-proxy-protocol: true

For "production readiness" a few features are still missing. Will they be supported and are they already supported?

• receive proxy protocol
• filter by IP source ranges like ingress-nginx does: loadBalancerSourceRanges: x.x.x.x/xx
• basic authentication like ingress-nginx does by annotation: nginx.ingress.kubernetes.io/auth-type: basic

[salonichf5]

We currently do not support proxy protocol in NGF

[mpstefan]

Although we do not support enabling proxy protocol in NGINX at the moment, we are working on a method to enable this and other NGINX configuration via extensions or attachments, as defined by the Gateway API.

Once we get the preliminary work out of the way to define where these various features can go, we SHOULD be able to deliver something like this pretty quickly. I did create an issue for this here for tracking: #1406

Going to see if we can fit this into our next release. The epic is still under construction, so don't look there quite yet. 🙂