Support for proxy-protocol for LoadBalancer is missing

[albundy83]

Hello,

according to issue #46, you explain that to have LoadBalancer with proxy-protocol support enabled, we need to create a stickiness policy call "proxy-protocol":

resource "outscale_load_balancer_policy" "proxy_protocol" {
   load_balancer_name = outscale_load_balancer.pub.id
   policy_name        = "proxy-protocol"
   policy_type        = "load_balancer"
}

But it's not the same that enabling proxy-protocol using this documentation https://docs.outscale.com/en/userguide/Configuring-Proxy-Protocol-for-Your-Load-Balancers.html.

Even with api, it's not possible: https://docs.outscale.com/api?console#createloadbalancer or https://docs.outscale.com/api?console#3ds-outscale-api-loadbalancerpolicy, it's always app or load_balancer as we are on stickiness policy.

But it exists here for example: https://github.com/outscale/cloud-provider-osc/blob/f0f87778379d50816850cf6f7cdeb933d161fdaa/cloud-controller-manager/osc/osc_loadbalancer.go#L658 and it works correctly.
As you can see, the policy-type-name must be ProxyProtocolPolicyType.

Is it possible that you add this feature please ?

[outscale-toa]

Hi @albundy83,

Thanks for reaching us, we are looking at your issue

Best regards,

[albundy83]

Hello,

any update on this request ?

I have tried to use aws terraform provider:

provider "aws" {
  access_key = var.access_key_id
  secret_key = var.secret_key_id
  region     = var.region

  # disable checks related to aws
  skip_region_validation      = true
  skip_credentials_validation = true
  skip_requesting_account_id  = true
  skip_metadata_api_check     = true

  endpoints {
    elb = "https://lbu.${var.region}.outscale.com"
  }
}

resource "aws_load_balancer_policy" "proxy-protocol-policy" {
  load_balancer_name = outscale_load_balancer.lb-kube-workers.load_balancer_name
  policy_name        = "ProxyProtocolPolicyName"
  policy_type_name   = "ProxyProtocolPolicyType"

  policy_attribute {
    name  = "ProxyProtocol"
    value = "true"
  }
}

resource "aws_load_balancer_backend_server_policy" "proxy-protocol-policy-80" {
  load_balancer_name = outscale_load_balancer.lb-kube-workers.load_balancer_name
  instance_port      = 80

  policy_names = [
    "ProxyProtocolPolicyName"
  ]
}

resource "aws_load_balancer_backend_server_policy" "proxy-protocol-policy-443" {
  load_balancer_name = outscale_load_balancer.lb-kube-workers.load_balancer_name
  instance_port      = 443

  policy_names = [
    "ProxyProtocolPolicyName"
  ]
}

But as lbu api does not have call to check creation of aws_load_balancer_policy (see https://docs.outscale.com/lbu#createloadbalancerpolicy), I have an error when terraform perform checks.
That's sad as it creates policy correctly.

The last 2 aws_load_balancer_backend_server_policy work correctly by the way.

[outscale-toa]

Hello @albundy83,

Due to unforeseen issues with our API, we will sadly not be able to deliver this feature by your timeline. Once the API issue has been addressed we will implement in terraform as soon as it will be available in our API.

Best Regards,

[albundy83]

Hello,

a friendly reminder, maybe with this new year, api issues will be fixed (happy new year !! :-) )

[outscale-toa]

Hello @albundy83,

Not yet, we will implement in terraform as soon as it will be available in our API, (happy new year )

Best Regards,

[nschmerber-doca]

Hello All,

I'm also facing the same issue.
Old documentations mentionned "proxy_protocol = true" in the listener block, but this doesnt work anymore in recent version terraform provider.

@outscale-toa is it possible to implement/fix it again ?

Regards,

[albundy83]

Hello,

until the new Outscale api support this feature, you still must interact with old lbu api.

Here some simple curl commands to enable proxy_protocol using the old api.

Create load balancer policy

Doc link

curl https://lbu.<outscale-region>.outscale.com \
  --user <access-key>:<secret-key> \
  --aws-sigv4 'aws:amz' \
  --data-urlencode 'Version=2012-06-01' \
  --data-urlencode 'Action=CreateLoadBalancerPolicy' \
  --data-urlencode 'LoadBalancerName=<your-load-balancer-name>' \
  --data-urlencode 'PolicyName=ProxyProtocolPolicyName' \
  --data-urlencode 'PolicyTypeName=ProxyProtocolPolicyType'

Assign it

Doc link

curl https://lbu.<outscale-region>.outscale.com \
  --user <access-key>:<secret-key> \
  --aws-sigv4 'aws:amz' \
  --data-urlencode 'Version=2012-06-01' \
  --data-urlencode 'Action=SetLoadBalancerPoliciesForBackendServer' \
  --data-urlencode 'InstancePort=443' \
  --data-urlencode 'LoadBalancerName=<your-load-balancer-name>' \
  --data-urlencode 'PolicyNames.member.1=ProxyProtocolPolicyName'

[outscale-rce]

Thank you very much @albundy83 for your detailed and thoughtful response. Unfortunately, @nschmerber-doca, at the moment, this is the best option we have for addressing this issue.

I have spoken with the team responsible for our API. They are aware that we need to address this particular problem with LBU, but for now, even though it’s a long-standing issue, there are no current plans to fix it.

I'm really sorry about that. As soon as we have more information, I will let you know guys.

Thanks again for your contributions,

Regards,