cloud-provider-openstack icon indicating copy to clipboard operation
cloud-provider-openstack copied to clipboard

[occm] LoadBalancer ProxyProtocol v2 feature

Open nicolaslacroux opened this issue 10 months ago • 4 comments

/kind feature

As a Kubernetes + occm user I would like to enabling the ProxyProtocol v2 as valid protocol with Octavia Load balancer.

What happened: Currently, it is not possible to create an Octavoia load balancer from the OCCM using the "ProxyProtocolv2" protocol.

loadbalancer.openstack.org/proxy-protocol: "true" # Enable ProxyProtocolv1
loadbalancer.openstack.org/proxy-protocol: "false" # Default value, no proxy protocol enable

What you expected to happen: Add proxy-protocol v2 annotations at Loadbalancer creation (Kubernetes service type LoadBalancer):

loadbalancer.openstack.org/proxy-protocol: "true" # Enable ProxyProtocolv1
loadbalancer.openstack.org/proxy-protocol: "v1" # Enable ProxyProtocolv1
loadbalancer.openstack.org/proxy-protocol: "v2" # Enable ProxyProtocolv2
loadbalancer.openstack.org/proxy-protocol: "false" # Default value, no proxy protocol enable 

Anything else we need to know?: Related Octavia documentation: https://docs.openstack.org/api-ref/load-balancer/v2/#protocol-combinations-listener-pool

As an Openstack Public Cloud Provider we are currently working on a custom CCM implementation, for this reason we can potentially do the PR associated with this request, but we'd like to at least validate the implementation before starting developments.

nicolaslacroux avatar Apr 26 '24 08:04 nicolaslacroux

@nicolaslacroux for me the spec seems valid. Another option could be add loadbalancer.openstack.org/proxy-protocol-version annotation to specify the version. However, as I see it we could do it in one annotation that can accept values that you mentioned.

cc @dulek do you have opinion?

zetaab avatar Apr 26 '24 19:04 zetaab

I like the design proposed and I see value in not introducing new annotations.

dulek avatar May 23 '24 09:05 dulek

@nicolaslacroux are you planning to implement this as you might have capable test environment to verify it? :)

zetaab avatar Jun 08 '24 19:06 zetaab

@zetaab We do not currently have the capacity to work on this feature, however we have plans to work on it in the coming months.

nicolaslacroux avatar Jun 14 '24 13:06 nicolaslacroux