Skip to content

Commit 58e4b21

Browse files
salonichf5salonichf5
committed
add proxy_protocol to server configuration
1 parent 2f627ce commit 58e4b21

File tree

12 files changed

+115
-9
lines changed

12 files changed

+115
-9
lines changed

‎apis/v1alpha1/nginxproxy_types.go

+6
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,12 @@ type NginxProxySpec struct {
5858
//
5959
// +optional
6060
DisableHTTP2 bool `json:"disableHTTP2,omitempty"`
61+
62+
// EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
63+
// Default is false, meaning the Proxy Protocol will be disabled.
64+
//
65+
// +optional
66+
EnableProxyProtocol bool `json:"enableProxyProtocol,omitempty"`
6167
}
6268

6369
// Telemetry specifies the OpenTelemetry configuration.

‎charts/nginx-gateway-fabric/values.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ nginx:
9393
{}
9494
# disableHTTP2: false
9595
# ipFamily: dual
96+
# enableProxyProtocol: true
9697
# telemetry:
9798
# exporter:
9899
# endpoint: otel-collector.default.svc:4317

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ spec:
5252
DisableHTTP2 defines if http2 should be disabled for all servers.
5353
Default is false, meaning http2 will be enabled for all servers.
5454
type: boolean
55+
enableProxyProtocol:
56+
description: |-
57+
EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
58+
Default is false, meaning the Proxy Protocol will be disabled.
59+
type: boolean
5560
ipFamily:
5661
default: dual
5762
description: |-

‎deploy/crds.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -697,6 +697,11 @@ spec:
697697
DisableHTTP2 defines if http2 should be disabled for all servers.
698698
Default is false, meaning http2 will be enabled for all servers.
699699
type: boolean
700+
enableProxyProtocol:
701+
description: |-
702+
EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
703+
Default is false, meaning the Proxy Protocol will be disabled.
704+
type: boolean
700705
ipFamily:
701706
default: dual
702707
description: |-

‎internal/mode/static/nginx/config/http/config.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ type ProxySSLVerify struct {
115115

116116
// ServerConfig holds configuration for an HTTP server and IP family to be used by NGINX.
117117
type ServerConfig struct {
118-
Servers []Server
119-
IPFamily IPFamily
118+
Servers []Server
119+
IPFamily IPFamily
120+
ProxyProtocol bool
120121
}

‎internal/mode/static/nginx/config/servers.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,9 @@ func executeServers(conf dataplane.Configuration) []executeResult {
6161
servers, httpMatchPairs := createServers(conf.HTTPServers, conf.SSLServers)
6262

6363
serverConfig := http.ServerConfig{
64-
Servers: servers,
65-
IPFamily: getIPFamily(conf.BaseHTTPConfig),
64+
Servers: servers,
65+
IPFamily: getIPFamily(conf.BaseHTTPConfig),
66+
ProxyProtocol: conf.BaseHTTPConfig.ProxyProtocol,
6667
}
6768

6869
serverResult := executeResult{

‎internal/mode/static/nginx/config/servers_template.go

+5-4
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,13 @@ server {
2828
}
2929
{{- else }}
3030
server {
31+
{{ $proxyProtocol := "" }}{{ if $.ProxyProtocol }}{{ $proxyProtocol = " proxy_protocol" }}{{ end }}
3132
{{- if $s.SSL }}
3233
{{- if $.IPFamily.IPv4 }}
33-
listen {{ $s.Port }} ssl;
34+
listen {{ $s.Port }} ssl{{ $proxyProtocol }};
3435
{{- end }}
3536
{{- if $.IPFamily.IPv6 }}
36-
listen [::]:{{ $s.Port }} ssl;
37+
listen [::]:{{ $s.Port }} ssl{{ $proxyProtocol }};
3738
{{- end }}
3839
ssl_certificate {{ $s.SSL.Certificate }};
3940
ssl_certificate_key {{ $s.SSL.CertificateKey }};
@@ -43,10 +44,10 @@ server {
4344
}
4445
{{- else }}
4546
{{- if $.IPFamily.IPv4 }}
46-
listen {{ $s.Port }};
47+
listen {{ $s.Port }}{{ $proxyProtocol }};
4748
{{- end }}
4849
{{- if $.IPFamily.IPv6 }}
49-
listen [::]:{{ $s.Port }};
50+
listen [::]:{{ $s.Port }}{{ $proxyProtocol }};
5051
{{- end }}
5152
{{- end }}
5253

‎internal/mode/static/nginx/config/servers_test.go

+25-1
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ func TestExecuteServers(t *testing.T) {
137137
}
138138
}
139139

140-
func TestExecuteServersForIPFamily(t *testing.T) {
140+
func TestExecuteServerConfig(t *testing.T) {
141141
httpServers := []dataplane.VirtualServer{
142142
{
143143
IsDefault: true,
@@ -230,6 +230,30 @@ func TestExecuteServersForIPFamily(t *testing.T) {
230230
"listen [::]:8443 ssl;": 1,
231231
},
232232
},
233+
{
234+
msg: "http and ssl servers with proxy protocol enabled",
235+
config: dataplane.Configuration{
236+
HTTPServers: httpServers,
237+
SSLServers: sslServers,
238+
BaseHTTPConfig: dataplane.BaseHTTPConfig{
239+
ProxyProtocol: true,
240+
},
241+
},
242+
expectedHTTPConfig: map[string]int{
243+
"listen 8080 default_server;": 1,
244+
"listen 8080 proxy_protocol;": 1,
245+
"listen 8443 ssl default_server;": 1,
246+
"listen 8443 ssl proxy_protocol;": 1,
247+
"server_name example.com;": 2,
248+
"ssl_certificate /etc/nginx/secrets/test-keypair.pem;": 1,
249+
"ssl_certificate_key /etc/nginx/secrets/test-keypair.pem;": 1,
250+
"ssl_reject_handshake on;": 1,
251+
"listen [::]:8080 default_server;": 1,
252+
"listen [::]:8080 proxy_protocol;": 1,
253+
"listen [::]:8443 ssl default_server;": 1,
254+
"listen [::]:8443 ssl proxy_protocol;": 1,
255+
},
256+
},
233257
}
234258

235259
for _, test := range tests {

‎internal/mode/static/state/dataplane/configuration.go

+6
Original file line numberDiff line numberDiff line change
@@ -678,6 +678,8 @@ func buildBaseHTTPConfig(g *graph.Graph) BaseHTTPConfig {
678678
// HTTP2 should be enabled by default
679679
HTTP2: true,
680680
IPFamily: Dual,
681+
// EnableProxyProtocol should be disabled by default
682+
ProxyProtocol: false,
681683
}
682684
if g.NginxProxy == nil || !g.NginxProxy.Valid {
683685
return baseConfig
@@ -696,6 +698,10 @@ func buildBaseHTTPConfig(g *graph.Graph) BaseHTTPConfig {
696698
}
697699
}
698700

701+
if g.NginxProxy.Source.Spec.EnableProxyProtocol {
702+
baseConfig.ProxyProtocol = true
703+
}
704+
699705
return baseConfig
700706
}
701707

‎internal/mode/static/state/dataplane/configuration_test.go

+28
Original file line numberDiff line numberDiff line change
@@ -2089,6 +2089,34 @@ func TestBuildConfiguration(t *testing.T) {
20892089
}),
20902090
msg: "NginxProxy with IPv6 IPFamily and no routes",
20912091
},
2092+
{
2093+
graph: getModifiedGraph(func(g *graph.Graph) *graph.Graph {
2094+
g.Gateway.Source.ObjectMeta = metav1.ObjectMeta{
2095+
Name: "gw",
2096+
Namespace: "ns",
2097+
}
2098+
g.Gateway.Listeners = append(g.Gateway.Listeners, &graph.Listener{
2099+
Name: "listener-80-1",
2100+
Source: listener80,
2101+
Valid: true,
2102+
Routes: map[graph.RouteKey]*graph.L7Route{},
2103+
})
2104+
g.NginxProxy = &graph.NginxProxy{
2105+
Valid: true,
2106+
Source: &ngfAPI.NginxProxy{
2107+
Spec: ngfAPI.NginxProxySpec{EnableProxyProtocol: true},
2108+
},
2109+
}
2110+
return g
2111+
}),
2112+
expConf: getModifiedExpectedConfiguration(func(conf Configuration) Configuration {
2113+
conf.SSLServers = []VirtualServer{}
2114+
conf.SSLKeyPairs = map[SSLKeyPairID]SSLKeyPair{}
2115+
conf.BaseHTTPConfig = BaseHTTPConfig{HTTP2: true, IPFamily: Dual, ProxyProtocol: true}
2116+
return conf
2117+
}),
2118+
msg: "NginxProxy with proxy protocol enabled",
2119+
},
20922120
}
20932121

20942122
for _, test := range tests {

‎internal/mode/static/state/dataplane/types.go

+2
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,8 @@ type BaseHTTPConfig struct {
300300
IPFamily IPFamilyType
301301
// HTTP2 specifies whether http2 should be enabled for all servers.
302302
HTTP2 bool
303+
// ProxyProtocol specifies whether the Proxy Protocol should be enabled for all servers.
304+
ProxyProtocol bool
303305
}
304306

305307
// IPFamilyType specifies the IP family to be used by NGINX.

‎site/content/reference/api.md

+26
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,19 @@ bool
339339
Default is false, meaning http2 will be enabled for all servers.</p>
340340
</td>
341341
</tr>
342+
<tr>
343+
<td>
344+
<code>enableProxyProtocol</code><br/>
345+
<em>
346+
bool
347+
</em>
348+
</td>
349+
<td>
350+
<em>(Optional)</em>
351+
<p>EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
352+
Default is false, meaning the Proxy Protocol will be disabled.</p>
353+
</td>
354+
</tr>
342355
</table>
343356
</td>
344357
</tr>
@@ -961,6 +974,19 @@ bool
961974
Default is false, meaning http2 will be enabled for all servers.</p>
962975
</td>
963976
</tr>
977+
<tr>
978+
<td>
979+
<code>enableProxyProtocol</code><br/>
980+
<em>
981+
bool
982+
</em>
983+
</td>
984+
<td>
985+
<em>(Optional)</em>
986+
<p>EnableProxyProtocol defines if the Proxy Protocol should be enabled for all servers.
987+
Default is false, meaning the Proxy Protocol will be disabled.</p>
988+
</td>
989+
</tr>
964990
</tbody>
965991
</table>
966992
<h3 id="gateway.nginx.org/v1alpha1.ObservabilityPolicySpec">ObservabilityPolicySpec

0 commit comments

Comments
 (0)