wzzirro opened a new issue, #111: URL: https://github.com/apache/cloudstack-kubernetes-provider/issues/111
### Problem When a Service of type `LoadBalancer` has `service.beta.kubernetes.io/cloudstack-load-balancer-proxy-protocol: "true"`, the CCM reports the load balancer IP in `status.loadBalancer.ingress` without `ipMode`. Kubernetes treats an empty `ipMode` as `VIP`, so kube-proxy binds the load balancer IP on every node and routes in-cluster traffic to that IP directly to the backend pods, bypassing the CloudStack load balancer. As a result, connections from inside the cluster (pods, or nodes themselves) to the public IP reach the backends without the PROXY protocol header. Backends that strictly require PROXY protocol (e.g. ingress-nginx / Envoy Gateway / HAProxy with `accept-proxy`) reject such connections, while external clients work fine. ### Steps to reproduce 1. Create a `LoadBalancer` Service with the PROXY protocol annotation in front of a backend that requires PROXY protocol. 2. From a pod in the same cluster, connect to the Service's external IP. 3. The connection is dropped by the backend (missing PROXY header). ### Expected behaviour For Services with PROXY protocol enabled, the CCM should set `ipMode: Proxy` (`LoadBalancerIngress.IPMode`, GA since Kubernetes 1.32, beta since 1.30) so kube-proxy sends in-cluster traffic through the load balancer, which adds the PROXY header. ### Notes `LoadBalancerIngress.IPMode` was added to `k8s.io/api` in v0.29, while the project currently depends on v0.24.17, so the k8s.io dependencies need to be bumped. I'll open a PR with the fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
