Skip to content

Commit abd690d

Browse files
arnaud-dezandeearnaud-dezandee
committed
feat: svc enable proxy protocol on specified ports
1 parent e5d625f commit abd690d

File tree

3 files changed

+126
-18
lines changed

3 files changed

+126
-18
lines changed

‎docs/guide/service/annotations.md

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
| [service.beta.kubernetes.io/aws-load-balancer-name](#load-balancer-name) | string | | |
2323
| [service.beta.kubernetes.io/aws-load-balancer-internal](#lb-internal) | boolean | false | deprecated, in favor of [aws-load-balancer-scheme](#lb-scheme)|
2424
| [service.beta.kubernetes.io/aws-load-balancer-scheme](#lb-scheme) | string | internal | |
25-
| [service.beta.kubernetes.io/aws-load-balancer-proxy-protocol](#proxy-protocol-v2) | string | | Set to `"*"` to enable |
25+
| [service.beta.kubernetes.io/aws-load-balancer-proxy-protocol](#proxy-protocol-v2) | string | | Set to `"*"` to enable for all service ports |
2626
| [service.beta.kubernetes.io/aws-load-balancer-ip-address-type](#ip-address-type) | string | ipv4 | ipv4 \| dualstack |
2727
| [service.beta.kubernetes.io/aws-load-balancer-access-log-enabled](#deprecated-attributes) | boolean | false | deprecated, in favor of [aws-load-balancer-attributes](#load-balancer-attributes)|
2828
| [service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-name](#deprecated-attributes) | string | | deprecated, in favor of [aws-load-balancer-attributes](#load-balancer-attributes)|
@@ -201,11 +201,17 @@ Traffic Listening can be controlled with following annotations:
201201
NLB resource attributes can be controlled via the following annotations:
202202

203203
- <a name="proxy-protocol-v2">service.beta.kubernetes.io/aws-load-balancer-proxy-protocol</a> specifies whether to enable proxy protocol v2 on the target group.
204-
Set to '*' to enable proxy protocol v2. This annotation takes precedence over the annotation `service.beta.kubernetes.io/aws-load-balancer-target-group-attributes`
205-
for proxy protocol v2 configuration.
204+
This annotation takes precedence over the annotation `service.beta.kubernetes.io/aws-load-balancer-target-group-attributes` for proxy protocol v2 configuration.
206205

207-
!!!note ""
208-
The only valid value for this annotation is `*`.
206+
!!!example
207+
- enable proxy protocol for all ports
208+
```
209+
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: *
210+
```
211+
- enable proxy protocol for ports 80 and 443
212+
```
213+
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: 80, 443
214+
```
209215

210216
- <a name="target-group-attributes">`service.beta.kubernetes.io/aws-load-balancer-target-group-attributes`</a> specifies the
211217
[Target Group Attributes](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#target-group-attributes) to be configured.

‎pkg/service/model_build_target_group.go

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ func (t *defaultModelBuildTask) buildTargetGroup(ctx context.Context, port corev
4444
if err != nil {
4545
return nil, err
4646
}
47-
tgAttrs, err := t.buildTargetGroupAttributes(ctx)
47+
tgAttrs, err := t.buildTargetGroupAttributes(ctx, port)
4848
if err != nil {
4949
return nil, err
5050
}
@@ -204,7 +204,7 @@ func (t *defaultModelBuildTask) buildTargetGroupName(_ context.Context, svcPort
204204
return fmt.Sprintf("k8s-%.8s-%.8s-%.10s", sanitizedNamespace, sanitizedName, uuid)
205205
}
206206

207-
func (t *defaultModelBuildTask) buildTargetGroupAttributes(_ context.Context) ([]elbv2model.TargetGroupAttribute, error) {
207+
func (t *defaultModelBuildTask) buildTargetGroupAttributes(_ context.Context, port corev1.ServicePort) ([]elbv2model.TargetGroupAttribute, error) {
208208
var rawAttributes map[string]string
209209
if _, err := t.annotationParser.ParseStringMapAnnotation(annotations.SvcLBSuffixTargetGroupAttributes, &rawAttributes, t.service.Annotations); err != nil {
210210
return nil, err
@@ -215,12 +215,18 @@ func (t *defaultModelBuildTask) buildTargetGroupAttributes(_ context.Context) ([
215215
if _, ok := rawAttributes[tgAttrsProxyProtocolV2Enabled]; !ok {
216216
rawAttributes[tgAttrsProxyProtocolV2Enabled] = strconv.FormatBool(t.defaultProxyProtocolV2Enabled)
217217
}
218-
proxyV2Annotation := ""
219-
if exists := t.annotationParser.ParseStringAnnotation(annotations.SvcLBSuffixProxyProtocol, &proxyV2Annotation, t.service.Annotations); exists {
220-
if proxyV2Annotation != "*" {
221-
return []elbv2model.TargetGroupAttribute{}, errors.Errorf("invalid value %v for Load Balancer proxy protocol v2 annotation, only value currently supported is *", proxyV2Annotation)
218+
var proxyV2Annotations []string
219+
if exists := t.annotationParser.ParseStringSliceAnnotation(annotations.SvcLBSuffixProxyProtocol, &proxyV2Annotations, t.service.Annotations); exists {
220+
for _, proxySelector := range proxyV2Annotations {
221+
if proxySelector == "*" {
222+
rawAttributes[tgAttrsProxyProtocolV2Enabled] = "true"
223+
break
224+
}
225+
if proxySelector == strconv.Itoa(int(port.Port)) {
226+
rawAttributes[tgAttrsProxyProtocolV2Enabled] = "true"
227+
break
228+
}
222229
}
223-
rawAttributes[tgAttrsProxyProtocolV2Enabled] = "true"
224230
}
225231
if rawPreserveIPEnabled, ok := rawAttributes[tgAttrsPreserveClientIPEnabled]; ok {
226232
_, err := strconv.ParseBool(rawPreserveIPEnabled)

‎pkg/service/model_build_target_group_test.go

Lines changed: 102 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,14 @@ package service
33
import (
44
"context"
55
"errors"
6-
"github.com/golang/mock/gomock"
7-
"sigs.k8s.io/aws-load-balancer-controller/pkg/model/core"
8-
"sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
96
"sort"
107
"strconv"
118
"testing"
129

10+
"github.com/golang/mock/gomock"
11+
"sigs.k8s.io/aws-load-balancer-controller/pkg/model/core"
12+
"sigs.k8s.io/aws-load-balancer-controller/pkg/networking"
13+
1314
"github.com/aws/aws-sdk-go/aws"
1415
"github.com/aws/aws-sdk-go/service/ec2"
1516
"github.com/stretchr/testify/assert"
@@ -26,6 +27,7 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
2627
tests := []struct {
2728
testName string
2829
svc *corev1.Service
30+
svcPort corev1.ServicePort
2931
wantError bool
3032
wantValue []elbv2.TargetGroupAttribute
3133
}{
@@ -36,6 +38,12 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
3638
Annotations: map[string]string{},
3739
},
3840
},
41+
svcPort: corev1.ServicePort{
42+
Name: "http",
43+
Port: 80,
44+
TargetPort: intstr.FromInt(8080),
45+
NodePort: 32768,
46+
},
3947
wantError: false,
4048
wantValue: []elbv2.TargetGroupAttribute{
4149
{
@@ -53,6 +61,12 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
5361
},
5462
},
5563
},
64+
svcPort: corev1.ServicePort{
65+
Name: "http",
66+
Port: 80,
67+
TargetPort: intstr.FromInt(8080),
68+
NodePort: 32768,
69+
},
5670
wantError: false,
5771
wantValue: []elbv2.TargetGroupAttribute{
5872
{
@@ -62,15 +76,73 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
6276
},
6377
},
6478
{
65-
testName: "Invalid value",
79+
testName: "no matching value",
6680
svc: &corev1.Service{
6781
ObjectMeta: metav1.ObjectMeta{
6882
Annotations: map[string]string{
6983
"service.beta.kubernetes.io/aws-load-balancer-proxy-protocol": "v2",
7084
},
7185
},
7286
},
73-
wantError: true,
87+
svcPort: corev1.ServicePort{
88+
Name: "http",
89+
Port: 80,
90+
TargetPort: intstr.FromInt(8080),
91+
NodePort: 32768,
92+
},
93+
wantValue: []elbv2.TargetGroupAttribute{
94+
{
95+
Key: tgAttrsProxyProtocolV2Enabled,
96+
Value: "false",
97+
},
98+
},
99+
wantError: false,
100+
},
101+
{
102+
testName: "matching value",
103+
svc: &corev1.Service{
104+
ObjectMeta: metav1.ObjectMeta{
105+
Annotations: map[string]string{
106+
"service.beta.kubernetes.io/aws-load-balancer-proxy-protocol": "80",
107+
},
108+
},
109+
},
110+
svcPort: corev1.ServicePort{
111+
Name: "http",
112+
Port: 80,
113+
TargetPort: intstr.FromInt(8080),
114+
NodePort: 32768,
115+
},
116+
wantValue: []elbv2.TargetGroupAttribute{
117+
{
118+
Key: tgAttrsProxyProtocolV2Enabled,
119+
Value: "true",
120+
},
121+
},
122+
wantError: false,
123+
},
124+
{
125+
testName: "multiple values",
126+
svc: &corev1.Service{
127+
ObjectMeta: metav1.ObjectMeta{
128+
Annotations: map[string]string{
129+
"service.beta.kubernetes.io/aws-load-balancer-proxy-protocol": "443, 80, 9090",
130+
},
131+
},
132+
},
133+
svcPort: corev1.ServicePort{
134+
Name: "http",
135+
Port: 80,
136+
TargetPort: intstr.FromInt(8080),
137+
NodePort: 32768,
138+
},
139+
wantValue: []elbv2.TargetGroupAttribute{
140+
{
141+
Key: tgAttrsProxyProtocolV2Enabled,
142+
Value: "true",
143+
},
144+
},
145+
wantError: false,
74146
},
75147
{
76148
testName: "target group attributes",
@@ -81,6 +153,12 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
81153
},
82154
},
83155
},
156+
svcPort: corev1.ServicePort{
157+
Name: "http",
158+
Port: 80,
159+
TargetPort: intstr.FromInt(8080),
160+
NodePort: 32768,
161+
},
84162
wantValue: []elbv2.TargetGroupAttribute{
85163
{
86164
Key: tgAttrsProxyProtocolV2Enabled,
@@ -111,6 +189,12 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
111189
},
112190
},
113191
},
192+
svcPort: corev1.ServicePort{
193+
Name: "http",
194+
Port: 80,
195+
TargetPort: intstr.FromInt(8080),
196+
NodePort: 32768,
197+
},
114198
wantValue: []elbv2.TargetGroupAttribute{
115199
{
116200
Key: tgAttrsProxyProtocolV2Enabled,
@@ -127,6 +211,12 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
127211
},
128212
},
129213
},
214+
svcPort: corev1.ServicePort{
215+
Name: "http",
216+
Port: 80,
217+
TargetPort: intstr.FromInt(8080),
218+
NodePort: 32768,
219+
},
130220
wantError: true,
131221
},
132222
{
@@ -138,6 +228,12 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
138228
},
139229
},
140230
},
231+
svcPort: corev1.ServicePort{
232+
Name: "http",
233+
Port: 80,
234+
TargetPort: intstr.FromInt(8080),
235+
NodePort: 32768,
236+
},
141237
wantError: true,
142238
},
143239
}
@@ -148,7 +244,7 @@ func Test_defaultModelBuilderTask_targetGroupAttrs(t *testing.T) {
148244
service: tt.svc,
149245
annotationParser: parser,
150246
}
151-
tgAttrs, err := builder.buildTargetGroupAttributes(context.Background())
247+
tgAttrs, err := builder.buildTargetGroupAttributes(context.Background(), tt.svcPort)
152248
if tt.wantError {
153249
assert.Error(t, err)
154250
} else {

0 commit comments

Comments
 (0)