PostgreSQL and proxy protocol of hetzner load balancer.

[vaceslav]

Hello,

I'm in the process of installing PostgreSQL using the cloudnative-pg operator, which has been quite straightforward and trouble-free.

Now, I'm looking to expose PostgreSQL port 5432 to the public internet. Although I understand the risks associated with port exposure, in my scenario, it's a development system and PostgreSQL needs to be accessible.

To accomplish this, I need to open TCP port 5432 in the Ingress controller. This can be achieved seamlessly by defining custom nginx-values, as shown below:

nginx_values = <<EOT
controller:
  watchIngressWithoutClass: "true"
  kind: "Deployment"
  replicaCount: 1
  config:
    "use-forwarded-headers": "true"
    "compute-full-forwarded-for": "true"
    "use-proxy-protocol": "true"
  service:
    annotations:
      "load-balancer.hetzner.cloud/name": "k3s-nginx"
      "load-balancer.hetzner.cloud/use-private-ip": "true"
      "load-balancer.hetzner.cloud/disable-private-ingress": "true"
      "load-balancer.hetzner.cloud/location": "fsn1"
      "load-balancer.hetzner.cloud/type": "lb11"
      "load-balancer.hetzner.cloud/uses-proxyprotocol": "true"
      "load-balancer.hetzner.cloud/algorithm-type": "round_robin"
      "load-balancer.hetzner.cloud/health-check-interval": "15s"
      "load-balancer.hetzner.cloud/health-check-timeout": "10s"
      "load-balancer.hetzner.cloud/health-check-retries": "3"
      "load-balancer.hetzner.cloud/hostname": "example.com"
tcp:
  5432: "default/cluster-example-rw:5432"
EOT

Upon applying these settings, a new port definition is added to the nginx-ingress controller, along with a corresponding service definition in the Hetzner load balancer.

However, a challenge arises because all three service definitions (for http, https, and 5432) in the load balancer have the "use proxyprotocol" flag enabled due to the line:

"load-balancer.hetzner.cloud/uses-proxyprotocol": "true"

Since PostgreSQL doesn't support the proxy protocol, it needs to be disabled specifically for the load balancer service on port 5432.

My question is: Is it possible to configure "load-balancer.hetzner.cloud/uses-proxyprotocol": "true/false" per load-balancer service?

Thanks

[melvin2016]

I'm also in the same situation, not able to find a solution to expose the port from hetzner LB.

[vaceslav]

Hi @melvin2016,

I’ve been thinking about this issue over the past few weeks. I don’t believe it’s a good idea to open the database port to the entire internet, even with Firewall rules in place. For my architecture, I decided to implement Zero Trust Network Access (ZTNA). I no longer open any non-standard ports to the internet. Instead, I create a private tunnel to the internal Kubernetes (K8S) network, allowing access to any services within Kubernetes.

To achieve this, I use the product Netbird, though there are other tools available that can accomplish the same task.

[melvin2016]

Hi @vaceslav, Thanks for reply and useful information. I will try out netbird. Thanks.