NLB proxy protocol enabled causes Nginx ingress controller to throw bad request

Question

I've a Kubernetes cluster which is hosted in AWS (EKS).

I'm trying to preserve the clients IPs. To do so, i tried enabling proxy protocol v2 in the network load balancer that sits in front of the cluster and configured the Nginx ingress controller to handle it.

Still, i'm receiving a bad request error without any kind of extra info on every request.

This is my Nginx ingress controller configMap

apiVersion: v1
data:
  allow-snippet-annotations: "true"
  compute-full-forwarded-for: "true"
  enable-real-ip: "true"
  server-snippet: "listen 8000;\nif ( $server_port = 80 ) {\n   return 308 https://$host$request_uri;\n}
    \  \n"
  ssl-redirect: "false"
  use-forwarded-headers: "true"
  use-proxy-protocol: "true"

Which translates into this in the Nginx config

    ## start server 
    server {
        server_name [REDACTED] ;
        
        listen 80 proxy_protocol ;
        listen 443 proxy_protocol ssl http2 ;
        
        set $proxy_upstream_name "-";
        
        ssl_certificate_by_lua_block {
            certificate.call()
        }
        
        location / {
            
            set $namespace      "[REDACTED]";
            set $ingress_name   "[REDACTED]";
            set $service_name   "[REDACTED]";
            set $service_port   "[REDACTED]";
            set $location_path  "/";
            set $global_rate_limit_exceeding n;
            
            rewrite_by_lua_block {
                lua_ingress.rewrite({
                    force_ssl_redirect = false,
                    ssl_redirect = false,
                    force_no_ssl_redirect = false,
                    preserve_trailing_slash = false,
                    use_port_in_redirects = false,
                    global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
                })
                balancer.rewrite()
                plugins.run()
            }
                        
            header_filter_by_lua_block {
                lua_ingress.header()
                plugins.run()
            }
            
            body_filter_by_lua_block {
                plugins.run()
            }
            
            log_by_lua_block {
                balancer.log()
                
                monitor.call()
                
                plugins.run()
            }
            
            port_in_redirect off;
            
            set $balancer_ewma_score -1;
            set $proxy_upstream_name "[REDACTED]";
            set $proxy_host          $proxy_upstream_name;
            set $pass_access_scheme  $scheme;
            
            set $pass_server_port    $proxy_protocol_server_port;
            
            set $best_http_host      $http_host;
            set $pass_port           $pass_server_port;
            
            set $proxy_alternative_upstream_name "";
            
            client_max_body_size                    20m;
            
            proxy_set_header Host                   $best_http_host;
                        
            # Allow websocket connections
            proxy_set_header                        Upgrade           $http_upgrade;
            
            proxy_set_header                        Connection        $connection_upgrade;
            
            proxy_set_header X-Request-ID           $req_id;
            proxy_set_header X-Real-IP              $remote_addr;
            
            proxy_set_header X-Forwarded-For        $full_x_forwarded_for;
            
            proxy_set_header X-Forwarded-Host       $best_http_host;
            proxy_set_header X-Forwarded-Port       $pass_port;
            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
            proxy_set_header X-Forwarded-Scheme     $pass_access_scheme;
            
            proxy_set_header X-Scheme               $pass_access_scheme;
            
            # Pass the original X-Forwarded-For
            proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
            
            proxy_set_header Proxy                  "";
                        
            proxy_connect_timeout                   5s;
            proxy_send_timeout                      3600s;
            proxy_read_timeout                      3600s;
            
            proxy_buffering                         off;
            proxy_buffer_size                       4k;
            proxy_buffers                           4 4k;
            
            proxy_max_temp_file_size                1024m;
            
            proxy_request_buffering                 on;
            proxy_http_version                      1.1;
            
            proxy_cookie_domain                     off;
            proxy_cookie_path                       off;
            
            proxy_next_upstream                     error timeout;
            proxy_next_upstream_timeout             0;
            proxy_next_upstream_tries               3;
            
            proxy_pass http://upstream_balancer;
            
            proxy_redirect                          off;
            
        }
        
        # Custom code snippet configured in the configuration configmap
        listen 8000;
        if ( $server_port = 80 ) {
            return 308 https://$host$request_uri;
        }   
        
    }
    ## end server

Proxy protocol v2 is enabled in my HTTPs target group through AWS Console, but when i hit any endpoint of the service, the result is

<html>

<head>
    <title>400 Bad Request</title>
</head>

<body>
    <center>
        <h1>400 Bad Request</h1>
    </center>
    <hr>
    <center>nginx</center>
</body>

</html>

Any help would be great.

Thanks in advance.

Answer 1

To configure NGINX to accept PROXY protocol headers, add the proxy_protocol parameter to the listen directive in a server block in the http {} or stream {} block. https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/

• Adding below worked for me

http {

    server {
        listen 80   proxy_protocol;

    }
}