Dynamic `proxyProtocol.trustedIPs` from the created service

[Gitopolis]

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you expect to see?

When I install traefik with this chart I can't know the list of trusted ips for the proxy protocol, because these ips will be available only after the LoadBalancer service is created. So as a workaround I first install traefik with the empty list, wait for the LoadBalancer to be created, then use dig to get the list of IPv4 and IPv6 addresses of my balancer. After that I can put them into the values file and redeploy the traefik.

The proposal is to automate this process. We can create a job that waits for the LB, and then update the traefik arguments. We can use ArgoCD sync waves to ensure the correct order in which the resources are created.

[mloiseleur]

Hello @Gitopolis,

That seems quite specific. 🤔 I am not sure if and how it could be implemented in this chart without adding a significant amount of complexity.

With this Chart, it's possible to disable the Service, and manage it. It seems possible to create a LoadBalancer Service before installing Traefik, get the IP (with dig or from the Service status field) and use this information as parameter in values of this Chart.

We are interested in this issue, but we’re unsure about the use case and the traction it will receive. We are going to leave the status as kind/proposal to give the community time to let us know if they would like this idea.

We will reevaluate as people respond.

[Gitopolis]

I think this problem can be solved once upstream have traefik/traefik#6551 fixed

[BornToBeRoot]

We have the same issue. I also don't want to add the whole vpc as trustedIPs...

I think it could help if you can set a dns entry (of the LB or a custom domain pointing to the lb...) instead of the IPs and traefik should resolve this. Many firewalls now do the same in their rules, since IPs often change...

I created a feature request here: traefik/traefik#11598

[mloiseleur]

I close this issue, since it should be implemented upstream first.
Feel free to re-open it or open a new one if you think you can improve the situation on this topic..