Question

DigitalOcean Load Balancer Proxy Protocol with Istio on DOKS

Hi folks,

I’m using Istio on DOKS with a DigitalOcean Load Balancer and would like to use proxy protocol to include a real IP header.

So far I’ve tried the following

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: proxy-protocol
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: LISTENER
    patch:
      operation: MERGE
      value:
        listener_filters:
        - name: envoy.filters.listener.proxy_protocol
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
        - name: envoy.filters.listener.tls_inspector
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ingressgateway-settings
  namespace: istio-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        filterChain:
          filter:
            name: envoy.http_connection_manager
    patch:
      operation: MERGE
      value:
        name: envoy.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
          skip_xff_append: false
          use_remote_address: true
          xff_num_trusted_hops: 1

along with a patch to the istio-ingressgateway Service in istio-system

apiVersion: v1
kind: Service
metadata:
  annotations:
    proxy.istio.io/config: '{"gatewayTopology" : { "numTrustedProxies": 2 } }'
    service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
  name: istio-ingressgateway
  namespace: istio-system

and my Istio config is located here: gitlab.com/islive.xyz/infra/-/blob/main/values/istio.yaml

however when I apply these configurations and visit a site routed through Istio, instead of the content I see the errors

upstream connect error or disconnect/reset before headers. reset reason: connection failure

Please note:

  • I do require Istio
  • I have had success with proxy-protocol with ingress-nginx in the past

Has anyone managed to get proxy-protocol to work with Istio and DigitalOcean Load Balancers?

Cheers, Caleb


Submit an answer


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel