Selectively enable PROXY Protocol for certain Load Balancer Ports

[jampy]

I use a ingress-nginx config like the following:

ingress-nginx:
  controller:
    kind: DaemonSet
    service:
      annotations:
        load-balancer.hetzner.cloud/location: nbg1
        load-balancer.hetzner.cloud/name: my-cluster-worker-lb
        load-balancer.hetzner.cloud/use-private-ip: "true"
        load-balancer.hetzner.cloud/uses-proxyprotocol: 'true'      # <------
        load-balancer.hetzner.cloud/hostname: redacted-host-name
        load-balancer.hetzner.cloud/http-redirect-https: 'false'

  tcp:
    1194: "openvpn/openvpn-service:1194"

As you can see, I enable the PROXY Protocol to reveal the external IP of HTTP/S connections. That works.

At the same time I use the same Nginx Ingress to forward TCP traffic to a OpenVPN server.

This basically works in that the OpenVPN port reaches the pods. The problem is that there is the PROXY Protocol header in the TCP data stream (which OpenVPN does not support).

I think this is because the port is configured on the Hetzner LB to use the PROXY PROTOCOL, just like the HTTP and HTTPS ports. Manually disabling the PROXY PROTOCOL for that port in the Hetzner Cloud Console solves the problem, but of course manually configuring things in the Console is not a solution.

Is it possible to configure this so that just the 1194 port is not configured to use the PROXY PROTOCOL?

[vitobotta]

AFAIK it's not possible to configure it on a per port basis, but let's see if others might have more info about it. Can you not just use a separate load balancer for that?

[jampy]

I think it's overkill to use another load balancer just to solve a configuration issue (especially since haproxy itself is able to handle the situation). That would be the third load balancer in a very simple cluster, each just for a single port.

In the meantime, I will probably solve this differently so that the VPN server is no longer part of the cluster itself.

Nevertheless, a solution to this problem would still be interesting for any kind of TCP connections in general, even if I no longer have an urgent use case at the moment.

[vitobotta]

It's more of a question for the Hetzner Cloud Controller Manager since I don't really have much control on how the load balancers are provisioned and configured by the CCM. Maybe you could open an issue there? https://github.com/hetznercloud/hcloud-cloud-controller-manager