Send signed proxy header to the kube service

Because it was checking version, which was empty, signed headers were not sent, when we contacted leaf cluster's kube service
gravitational · Mar 29, 2023 · ea5660d · ea5660d
1 parent d305416
commit ea5660d
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/lib/reversetunnel/transport.go b/lib/reversetunnel/transport.go
@@ -325,7 +325,8 @@ func (p *transport) start() {
 		clientDst = dst
 	}
 	var signedHeader []byte
-	if shouldSendSignedPROXYHeader(p.proxySigner, dreq.TeleportVersion, useTunnel, dreq.Address != RemoteAuthServer, clientSrc, clientDst) {
+	isKubeOrAuth := dreq.ConnType == types.KubeTunnel || dreq.Address == RemoteAuthServer
+	if shouldSendSignedPROXYHeader(p.proxySigner, dreq.TeleportVersion, useTunnel, !isKubeOrAuth, clientSrc, clientDst) {
 		signedHeader, err = p.proxySigner.SignPROXYHeader(clientSrc, clientDst)
 		if err != nil {
 			errorMessage := fmt.Sprintf("connection rejected - could not create signed PROXY header: %v", err)