DOCS: Add clarification regarding ssl passthrough #2377
Conversation
k8s-ci-robot
added
cncf-cla: yes
docs/user-guide/annotations.md
Outdated
| @@ -348,7 +348,7 @@ The annotation `nginx.ingress.kubernetes.io/ssl-passthrough` allows to configure | |||
| **Important:** | |||
|
|
|||
| - Using the annotation `nginx.ingress.kubernetes.io/ssl-passthrough` invalidates all the other available annotations. This is because SSL Passthrough works in L4 (TCP). | |||
| - The use of this annotation requires the flag `--enable-ssl-passthrough` (By default it is disabled) | |||
| - The use of this annotation requires proxy protocol to be enabled in load balancer. For example enabling proxy protocol for AWS ELB described [here](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-proxy-protocol.html). If you're using ingress-controller without load balancer then the flag `--enable-ssl-passthrough` required (By default it is disabled). | |||
There was a problem hiding this comment.
"in the load-balancer"
"P roxy P rotocol"
"for AWS ELB is described"
"flag --enable-ssl-passthroughis required"
"b y default"
|
@antoineco Thanks 👍 Addressed. |
Codecov Report
@@ Coverage Diff @@
## master #2377 +/- ##
=======================================
Coverage 39.12% 39.12%
=======================================
Files 73 73
Lines 5204 5204
=======================================
Hits 2036 2036
Misses 2878 2878
Partials 290 290Continue to review full report at Codecov.
|
|
Looks like failure is not related. Can i do anything? |
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
/assign @aledbf |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aledbf, antoineco, r7vme The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
|
@r7vme it's being taken care of ;) |
What this PR does / why we need it:
This PR adds clarification regarding using
--enable-ssl-passthroughflag if external load balances are used.I've plunged into the issue with Go-based SSL proxying done by ingress-controller. Finally i found out that i can safely disable built-in SSL proxying, if i already have proxy protocol enabled on load balancer. See my last comment for details.
Which issue this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close that issue when PR gets merged): fixes #related: #2354
Special notes for your reviewer:
None