Question

DigitalOcean Load Balancer Proxy Protocol with Istio on DOKS

Posted on February 4, 2024
DigitalOcean Managed Load Balancers DigitalOcean Managed Kubernetes
Asked by Caleb Woodbine

Hi folks,

I’m using Istio on DOKS with a DigitalOcean Load Balancer and would like to use proxy protocol to include a real IP header.

So far I’ve tried the following

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: proxy-protocol
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: LISTENER
    patch:
      operation: MERGE
      value:
        listener_filters:
        - name: envoy.filters.listener.proxy_protocol
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
        - name: envoy.filters.listener.tls_inspector
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ingressgateway-settings
  namespace: istio-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        filterChain:
          filter:
            name: envoy.http_connection_manager
    patch:
      operation: MERGE
      value:
        name: envoy.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
          skip_xff_append: false
          use_remote_address: true
          xff_num_trusted_hops: 1

along with a patch to the istio-ingressgateway Service in istio-system

apiVersion: v1
kind: Service
metadata:
  annotations:
    proxy.istio.io/config: '{"gatewayTopology" : { "numTrustedProxies": 2 } }'
    service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
  name: istio-ingressgateway
  namespace: istio-system

and my Istio config is located here: gitlab.com/islive.xyz/infra/-/blob/main/values/istio.yaml

however when I apply these configurations and visit a site routed through Istio, instead of the content I see the errors

upstream connect error or disconnect/reset before headers. reset reason: connection failure

Please note:

I do require Istio
I have had success with proxy-protocol with ingress-nginx in the past

Has anyone managed to get proxy-protocol to work with Istio and DigitalOcean Load Balancers?

Cheers, Caleb

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

clientvincent • July 27, 2024

Accepted Answer

My istio operator

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  meshConfig:
    enableTracing: true
    defaultConfig:
      tracing:
        sampling: 10
      holdApplicationUntilProxyStarts: true
    outboundTrafficPolicy:
      mode: ALLOW_ANY # Allow any outbound traffic
  components:
    pilot:
      enabled: true
      k8s:
        env:
          - name: PILOT_HTTP10
            value: "1"
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
        k8s:
          serviceAnnotations:
            service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
          service:
            externalTrafficPolicy: Local

the envoyFilter

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: proxy-protocol
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: LISTENER
    patch:
      operation: MERGE
      value:
        listener_filters:
        - name: "envoy.filters.listener.proxy_protocol"
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
        - name: "envoy.filters.listener.tls_inspector"
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector```
            
With this setup, I can enable the DOKS proxy protocol on my Istio ingress gateway and receive traffic

todor-dobrev-kasha • March 19, 2024

Hello,

Were you able to succeed with setting up istio with proxy protocol ?

I am trying to do the same to no avail.