How to set proxy-real-ip-cidr

[InsOpDe]

Im using hetzner loadbalancers with nginx-ingress-controller with 10.42.0.0/24 as network with following config:

  config:
    use-proxy-protocol: "true"
    proxy-real-ip-cidr: '10.42.0.0/24'

and

    annotations:
      service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
      load-balancer.hetzner.cloud/name: "external-lb"
      load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
      load-balancer.hetzner.cloud/location: "ngb1"

Now my requests include the real-ip headers. Thats a good thing!

But now, if I want to make a request from inside the network:

curl <loadbalancer-ip> -Ls -o /dev/null --header "Host: some-ingress-url.example.com" -v

I get

*   Trying <loadbalancer-ip>:80...
* TCP_NODELAY set
* Connected to <loadbalancer-ip> port 80 (#0)
> GET / HTTP/1.1
> Host: some-ingress-url.example.com
> User-Agent: curl/7.68.0
> Accept: */*
>
* Empty reply from server
* Connection #0 to host <loadbalancer-ip> left intact

And nginx logs:

2021/03/01 16:06:16 [error] 2669#2669: *4565505 broken header: "GET / HTTP/1.1
Host: some-ingress-url.example.com
User-Agent: curl/7.68.0
Accept: */*

" while reading PROXY protocol, client: 10.42.2.195, server: 0.0.0.0:80

Now that sucks!

My limited understanding tells me that this is what proxy-real-ip-cidr is for. And I guess that hetzners loadbalancers does need this info, too. I tried utilizing load-balancer.hetzner.cloud/disable-private-ingress: "true" not entirely sure what that means but with no success.

I do not know whether this is by design, or whether my configuration is just wrong.

Workaround would be to use internal names like servicename.namespace.svc.cluster.local instead, but Im curious whether there is a better solution

[LKaemmerling]

Hey, basically you encountered a "bug" within the kube proxy (kubernetes/kubernetes#66607). If you use the Load Balancer IP in-cluster the request will never reach the Load Balancer. Therefore we would recommend using the in cluster name or using the load-balancer.hetzner.cloud/hostname annotation.

[InsOpDe]

perfect, this worked!

I just took some arbitrary hostname something.example.com for the annotation and it works now

[EarthlingDavey]

config:
 use-proxy-protocol: "true"
annotations:
 service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
 load-balancer.hetzner.cloud/uses-proxyprotocol: "true"

Is this documented anywhere? I couldn't find it any reference in any docs. Thanks... load-balancer.hetzner.cloud/uses-proxyprotocol: "true" is a life saver 👊🏼✌️