DigitalOcean Load Balancer Proxy Protocol with Istio on DOKS

Hi folks,

I’m using Istio on DOKS with a DigitalOcean Load Balancer and would like to use proxy protocol to include a real IP header.

So far I’ve tried the following

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: proxy-protocol
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: LISTENER
    patch:
      operation: MERGE
      value:
        listener_filters:
        - name: envoy.filters.listener.proxy_protocol
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
        - name: envoy.filters.listener.tls_inspector
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ingressgateway-settings
  namespace: istio-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        filterChain:
          filter:
            name: envoy.http_connection_manager
    patch:
      operation: MERGE
      value:
        name: envoy.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
          skip_xff_append: false
          use_remote_address: true
          xff_num_trusted_hops: 1

along with a patch to the istio-ingressgateway Service in istio-system

apiVersion: v1
kind: Service
metadata:
  annotations:
    proxy.istio.io/config: '{"gatewayTopology" : { "numTrustedProxies": 2 } }'
    service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
  name: istio-ingressgateway
  namespace: istio-system

and my Istio config is located here: gitlab.com/islive.xyz/infra/-/blob/main/values/istio.yaml

however when I apply these configurations and visit a site routed through Istio, instead of the content I see the errors

upstream connect error or disconnect/reset before headers. reset reason: connection failure

Please note:

• I do require Istio
• I have had success with proxy-protocol with ingress-nginx in the past

Has anyone managed to get proxy-protocol to work with Istio and DigitalOcean Load Balancers?

Cheers, Caleb