teleport icon indicating copy to clipboard operation
teleport copied to clipboard

ha-autoscale-cluster: Enable proxy protocol to allow the use of IP pinning

Open webvictim opened this issue 9 months ago • 0 comments

Changelog: Enabled the use of proxy protocol v2 for the ha-autoscale-cluster Terraform deployment example, allowing clusters deployed with this code to make use of IP pinning where needed.

Also:

  • fixed a bug with the ACM LB name used when an alias was not provided
  • made the connect.sh script more reliable by only targetting instances in running state

Fixes https://github.com/gravitational/teleport/issues/34284

Test matrix:

use_acm use_tls_routing auth_service proxy_protocol proxy_service proxy_protocol LBs deployed
false false on on auth: NLB, proxy: NLB
true false on not set auth: NLB, proxy: ALB + NLB
false true on on auth: NLB, proxy: NLB
true true on not set auth: NLB, proxy: ALB

proxy_protocol does not need to be set to on when an ALB is used, as proxy_service.trust_x_forwarded_for is set to true in these situations and the client IP is derived from the X-Forwarded-For header.

The starter-cluster deployment only deploys an ALB when ACM is enabled, so remains unchanged.

webvictim avatar May 16 '24 19:05 webvictim