Hide Forgot
Description of problem: When the proxy protocol configuration was implemented, for some reason it was only implemented for "HostNetwork" and "NodePort" endpoint publishing strategies, but not for "Private" one. We should be able to implement it in the "Private" one. OpenShift release version: 4.10 Cluster Platform: Irrelevant. How reproducible: Always Steps to Reproduce (in detail): 1. Configure proxy protocol for "private" endpoint publishing strategy 2. 3. Actual results: Not configurable Expected results: Configurable Impact of the problem: In some environments where "private" strategy + custom service must be used, lacking proxy protocol hides real source IPs to the router, which can have severe security implications. Additional info: The PROXY protocol was implemented as a result of https://issues.redhat.com/browse/RFE-401 . Neither in the RFE nor in the trackers I can find any reference for why this was implemented only for those strategies, as it was requested as just a global option. So this means the feature was implemented mistakenly, which is a bug.
We will handle this as a BZ.
Verified in "4.12.0-0.nightly-2022-07-17-174647" release. With this payload, it is observed that the "Private" type ingresscontroller allows the "PROXY" option to be set correctly in the pod configuration: ------ oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.12.0-0.nightly-2022-07-17-174647 True False 3h22m Cluster version is 4.12.0-0.nightly-2022-07-17-174647 oc -n openshift-ingress-operator get ingresscontroller internalapps -o jsonpath={.spec} | jq { "clientTLS": { "clientCA": { "name": "" }, "clientCertificatePolicy": "" }, "domain": "internalapps.aiyengar412qq.qe.azure.devcluster.openshift.com", "endpointPublishingStrategy": { "private": { "protocol": "PROXY" }, "type": "Private" }, oc -n openshift-ingress get pods -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES router-internalapps-57df5858b6-5885h 2/2 Running 0 37s 10.131.0.20 aiyengar412qq-7mm4j-worker-southcentralus1-t8lbw <none> <none> router-internalapps-57df5858b6-znzqj 2/2 Running 0 37s 10.128.2.20 aiyengar412qq-7mm4j-worker-southcentralus3-9z2tv <none> <none> oc -n openshift-ingress exec router-internalapps-57df5858b6-5885h -- env | grep ROUTER_USE_PROXY_PROTOCOL ROUTER_USE_PROXY_PROTOCOL=true oc -n openshift-ingress exec router-internalapps-57df5858b6-5885h -- cat haproxy.config| grep -i 'accept-proxy' bind :80 accept-proxy bind :443 accept-proxy ------
We will be backporting the fix to 4.11.z and 4.10.z.
Thanks
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.12.0 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:7399