nginx-based ssl passthrough support with SNI

[r7vme]

Is this a BUG REPORT or FEATURE REQUEST? (choose one): FEATURE REQUEST

At the moment ingress controller implements own proxy for ssl passthrough cases. It runs in own go routine that does three things:

1. extracts SNI
2. adds PROXY protocol header
3. does piping between two TCP connections directly to backend (Kubernetes service)

It would be great to have 1 and 3 done by nginx. 2 is only needed, when your clients going directly to ingress-controller w/o load-balancer and support proxy protocol. Not needed if external load balancer already does PROXY protocol (e.g. AWS ELB and HAProxy).

[aledbf]

It would be great to have 1 and 3 done by nginx.

Agree. The issue with that approach is that you lose the source IP address (client).

[aledbf]

@r7vme the problem is that using the sni preread feature implies the use of an upstream so you receive a connection from nginx itself

Please check https://github.com/kubernetes/ingress-nginx/pull/614/files#diff-b7803798d356c6c17a90d93cc58bdbaaL480

[r7vme]

@r7vme the problem is that using the sni preread feature implies the use of an upstream so you receive a connection from nginx itself

I think with "piping" you also receive connection from ingress-controller? That's why PROXY protocol is in place, to keep initial client IP.

[r7vme]

In our case, we don't need PROXY support in ingress as we use either ELB or Nginx. Are there are many people using ingress-controller w/o load-balancers in front?

Not top priority, but having ability to skip additional layer (Go based proxy) in data path would be great. Unfortunately we still need ssl-passthru, so we can not disable it completely.

[aledbf]

Not top priority, but having ability to skip additional layer (Go based proxy)

I want to change that but losing the source IP address is a deal breaker.

[r7vme]

I want to change that but losing the source IP address is a deal breaker.

Definitely, but i think it's possible to make Go proxy optional for cases, when PROXY protocol enabled on load balancer (ELB, HAProxy). In general, do you think will it work? I can work on PR based on initial implmentation here

[kfox1111]

I use nginx-ingress without a lb in front.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[nrobert13]

Not top priority, but having ability to skip additional layer (Go based proxy)

I want to change that but losing the source IP address is a deal breaker.

@aledbf , but in case of passthrough, you do not touch the original package, so it still contains the HOST header. Isn't this the source of the client IP?

[aledbf]

Isn't this the source of the client IP?

No, because once we read the TLS sni hello in the stream section we need to send the connection to a nginx upstream and that means NGINX opens a new connection to the upstream server. That's the reason why we lose the source IP address. There is no option to "just" pipe the connection.

[nrobert13]

I see, I guess the main reason for ssl-passthrough is ssl-client authn. is it that important to keep the client ip?

[aledbf]

is it that important to keep the client ip?

Most of the users want this information

[nrobert13]

I guess then, the only way is proxy protocol. This seems to be a solution .. https://stackoverflow.com/questions/48211083/proxy-protocol-and-ssl

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.