Support for proxy protocol v2

[UltraInstinct14]

Is your feature request related to a problem? Please describe.
In many NAT nodes used by loxilb, the original sourceIP gets obfuscated at the endpoint. It might result in problem of accounting various things related to the original source such as abuse, DDOS attacks or to keep simple statistical counts.

Describe the solution you'd like
loxilb needs to implement proxy protocol v2. Currently many web-servers already support it

Describe alternatives you've considered
N/A

Additional context
https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt

[6547709]

I also need this feature;
Background:
I have always used the architecture of deploying LoadBalancer outside the cluster, which has a clear architecture, short path (LB->PodIP), and better performance (adjusting virtual machine/bare metal configuration). When I use TCP service or Ingress, the source IP (one-arm/FullNAT) cannot be correctly identified;
Requirement:
If LoxiLB can support Proxy protocol V2, these problems can be solved.

[barryiron]

Also in need of this feature, would be great if it can be prioritized. Thanks!

[TrekkieCoder]

Landed initial support. Details can be found here

[6547709]

I just did a test, using Ingress-Nginx, but I can't access ingress.

ingress-nginx logs(10.40.41.91/92 is loxilb'ip):

2024/11/27 14:05:00 [error] 578#578: *96633 broken header: "" while reading PROXY protocol, client: 10.40.41.91, server: 0.0.0.0:443
2024/11/27 14:05:00 [error] 862#862: *96700 broken header: "" while reading PROXY protocol, client: 10.40.41.92, server: 0.0.0.0:443

apiVersion: v1
kind: Service
metadata:
  annotations:
    loxilb.io/staticIP: 10.60.11.10
    loxilb.io/usepodnetwork: "yes"
    loxilb.io/useproxyprotov2: "yes"
    meta.helm.sh/release-name: ingress-nginx
    meta.helm.sh/release-namespace: ingress-nginx
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  allocateLoadBalancerNodePorts: true
  clusterIP: 10.253.5.62
  clusterIPs:
  - 10.253.5.62
  externalTrafficPolicy: Local
  healthCheckNodePort: 32261
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  loadBalancerClass: loxilb.io/loxilb
  ports:
  - appProtocol: http
    name: http
    nodePort: 30624
    port: 80
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    nodePort: 30100
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  sessionAffinity: None
  type: LoadBalancer

core@LoxiLB-02 ~ $ docker exec -it loxilb loxicmd get lb -o wide
|   EXT IP    | SEC IPS | SOURCES | HOST | PORT | PROTO |                      NAME                      | MARK | SEL  |     MODE     |   ENDPOINT   | EPORT | WEIGHT | STATE  | COUNTERS  |
|-------------|---------|---------|------|------|-------|------------------------------------------------|------|------|--------------|--------------|-------|--------|--------|-----------|
| 10.60.11.10 |         |         |      |   80 | tcp   | ingress-nginx_ingress-nginx-controller:default |    0 | rr   | fullnat:ppv2 | 10.254.2.137 |    80 |      1 | -      | 0:0       |
|             |         |         |      |      |       |                                                |      |      |              | 10.254.5.137 |    80 |      1 | -      | 0:0       |
|             |         |         |      |      |       |                                                |      |      |              | 10.254.6.144 |    80 |      1 | -      | 0:0       |
|             |         |         |      |      |       |                                                |      |      |              | 10.254.1.185 |    80 |      1 | -      | 0:0       |
| 10.60.11.10 |         |         |      |  443 | tcp   | ingress-nginx_ingress-nginx-controller:default |    0 | rr   | fullnat:ppv2 | 10.254.2.137 |   443 |      1 | -      | 86:56498  |
|             |         |         |      |      |       |                                                |      |      |              | 10.254.5.137 |   443 |      1 | -      | 104:66842 |
|             |         |         |      |      |       |                                                |      |      |              | 10.254.6.144 |   443 |      1 | -      | 103:65749 |
|             |         |         |      |      |       |                                                |      |      |              | 10.254.1.185 |   443 |      1 | -      | 88:57036  |

core@LoxiLB-02 ~ $ docker exec -it loxilb loxicmd get ip
| DEVICE NAME |          IP ADDRESS          |
|-------------|------------------------------|
| docker0     | 172.17.0.1/16                |
| ens192      | 10.40.41.92/24               |
|             | fe80::250:56ff:fe88:1e5c/64  |
| ens224      | 10.60.2.92/16                |
|             | fe80::250:56ff:fe88:93a/64   |
| llb0        | fe80::acbb:f9ff:fef1:d170/64 |
| lo          | 127.0.0.1/8                  |
|             | ::1/128                      |
|             | 10.60.11.7/32                |
|             | 10.60.11.3/32                |
|             | 10.60.11.4/32                |
|             | 10.60.11.5/32                |
|             | 10.60.11.10/32               |

[UltraInstinct14]

Was able to test based on instructions for v2 here. My setup does not have an ingress. I am running an nginx app pod (LB -> nginx pods).

[6547709]

ok. I'll look into why it doesn't work.