{"action":"opened","issue":{"url":"https://api.github.com/repos/kubernetes/ingress/issues/659","repository_url":"https://api.github.com/repos/kubernetes/ingress","labels_url":"https://api.github.com/repos/kubernetes/ingress/issues/659/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/ingress/issues/659/comments","events_url":"https://api.github.com/repos/kubernetes/ingress/issues/659/events","html_url":"https://github.com/kubernetes/ingress/issues/659","id":224636774,"number":659,"title":"[nginx] TCP configmap should allow stream proxy_protocol per service","user":{"login":"donaldguy","id":43136,"avatar_url":"https://avatars0.githubusercontent.com/u/43136?v=3","gravatar_id":"","url":"https://api.github.com/users/donaldguy","html_url":"https://github.com/donaldguy","followers_url":"https://api.github.com/users/donaldguy/followers","following_url":"https://api.github.com/users/donaldguy/following{/other_user}","gists_url":"https://api.github.com/users/donaldguy/gists{/gist_id}","starred_url":"https://api.github.com/users/donaldguy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/donaldguy/subscriptions","organizations_url":"https://api.github.com/users/donaldguy/orgs","repos_url":"https://api.github.com/users/donaldguy/repos","events_url":"https://api.github.com/users/donaldguy/events{/privacy}","received_events_url":"https://api.github.com/users/donaldguy/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-04-27T00:32:15Z","updated_at":"2017-04-27T00:32:15Z","closed_at":null,"body":"We run a (special cased, locked down) ssh server for some of our production sites. It is is our desire for there to be hosts with `:443` TLS terminated and passing into an upstream HTTP service and another port for the same hostname to pass to a (the same for all hostnames—ssh has no vhost concept) sshd in another pod\r\n\r\nWe run in AWS.\r\n\r\nPreviously we have achieved this by using a setup much like https://github.com/kubernetes/ingress/blob/b01dc68e30d935bc7845e40e85bc6b99ddb320a0/examples/aws/nginx/nginx-ingress-controller.yaml\r\nand then additionally manually opening SG rules and a listener to a NodePort service for the sshd pod\r\n\r\nThis works most of the time. But occasionally we find suddenly that the manually added rules are reverted\r\n\r\nToday, I tried doing as https://github.com/kubernetes/ingress/tree/b01dc68e30d935bc7845e40e85bc6b99ddb320a0/examples/tcp/nginx\r\n\r\nand also adding the port mappings through the type LoadBalancer service\r\n\r\nThis worked for one other raw TCP service we run in the cluster; for SSH it just gets us `Bad protocol version identification 'PROXY TCP4 $SOURCE_IP 172.21.74.176 57359 $SSH_PORT' from 100.96.5.223 port 50992` in our sshd logs before the sshd drops the connection.\r\n\r\nAs reported in kubernetes/kubernetes#42616 there does not appear to be a way to prevent the `Service` type `LoadBalancer` from enabling AWS proxy protocol on all ports. I could manually remove, but I suspect that like my manual listeners might be reverted by the controller-manager at a later time.\r\n\r\nAdditionally as reported in kubernetes/contrib#2258 there isn't currently a way to add `proxy_protocol` to the `listen` in server blocks inside the `stream`; this does seem to be supported https://nginx.org/en/docs/stream/ngx_stream_core_module.html#listen so I believe this should be a change to  https://github.com/kubernetes/ingress/blob/b01dc68e30d935bc7845e40e85bc6b99ddb320a0/controllers/nginx/rootfs/etc/nginx/template/nginx.tmpl#L505 and the tcp configmap parser\r\n\r\nMy ideal would actually also be for `--publish-service` to handle the additional port mappings, but I can live without that."}}
{"actor":{"display_login":"donaldguy"}}