How to set up Nginx Ingress for Load Balancers with Proxy Protocol Support

I got it working!!! The answer is to create a config map with use-proxy-protocol: “true” as follows:

Step 1. Follow instructions from the tutorial

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/cloud-generic.yaml

Step 2. Create the following configmap.yaml that includes use-proxy-protocol:

# configmap.yaml
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
data:
  use-forwarded-headers: "true"
  compute-full-forwarded-for: "true"
  use-proxy-protocol: "true"

Step 3. Apply configmap.yaml

kubectl apply -f configmap.yaml

Step 4. Create your ingress resource:

# ingress.yaml
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: echo-ingress
spec:
  rules:
  - host: echo1.example.com
    http:
      paths:
      - backend:
          serviceName: echo1
          servicePort: 80
  - host: echo2.example.com
    http:
      paths:
      - backend:
          serviceName: echo2
          servicePort: 80

Step 5. Apply your ingress resource:

kubectl apply -f ingress.yaml

Step 6. Wait for the External IP of your load balancer

kubectl get svc -n ingress-nginx

Step 7. Enable Proxy Protocol on your load balancer

Step 8. Update your DNS A records with your External IP

Best of luck …

BTW … there’s an issue with proxy protocol and the jet stack cert-manager.

See https://github.com/jetstack/cert-manager/issues/466

My only workaround is to temporarily disable proxy protocol on the load balancer (and nginx ingress config map) allowing the certificate to be issued.

kubectl edit configmap -n ingress-nginx nginx-ingress-controller
#  use-proxy-protocol: "true"

For anyone using Helm, you can replace steps 1, 2 and 3 (above) with the following …

# nginx-ingress-controller-config.yaml
controller:
  config:
    use-forwarded-headers: "true"
    compute-full-forwarded-for: "true"
    use-proxy-protocol: "true"

helm install --namespace ingress-nginx --name nginx-ingress stable/nginx-ingress -f nginx-ingress-controller-config.yaml