For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Enabling the PROXY protocol allows a load balancer managed within a Kubernetes cluster to forward client connection information (such as client IP addresses) to the nodes. The software running on the nodes must be configured to accept the connection information from the load balancer and have the ability to parse the PROXY protocol data.

If your load balancer is backed by an ingress controller, the ingress controller itself must support the PROXY protocol. You need to first enable PROXY protocol within the ingress controller and then enable it for the load balancer. Otherwise, the ingress controller cannot parse the PROXY protocol, which can lead to disruptions in traffic flow.

This example uses nginx installed using the Kubernetes 1-Click App but the following steps can also be used for instances of nginx and DigitalOcean Load Balancers deployed using Helm charts or manifests.

1. Edit the ConfigMap that nginx uses for custom configurations. Typically, the ConfigMap file is in the same namespace where nginx is deployed. You can run helm ls -A to check the namespace where nginx is installed. Run the following command to edit the ConfigMap using your namespace and service name:

   kubectl edit configmap -n <namespace> <service-name>

2. Add use-proxy-protocol = "true" to the data section in the ConfigMap and save the file:

   apiVersion: v1
   data:
      allow-snippet-annotations: "true"
      use-proxy-protocol: "true"
   kind: ConfigMap
   metadata:
   annotations:
       ....
   labels:
       ...
   name: ingress-nginx-controller

   PROXY protocol is now enabled in the NGINX Ingress Controller, allowing it to parse the PROXY protocol header.

3. Open the service config file for the load balancer by running the following command using your namespace and service name:

   kubectl edit service -n <namespace> <service-name>

4. Add service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true" to the annotations section in the service config file and save the file.

   apiVersion: v1
   kind: Service
   metadata:
   annotations:
       kubernetes.digitalocean.com/load-balancer-id: f55b4d90-your-load-balancer-id-4b1a29c40ff
       service.beta.kubernetes.io/do-loadbalancer-type: "REGIONAL"
       service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true" 
   labels:
       ...
   name: ingress-nginx-controller

5. If any workloads inside the cluster send requests to this load balancer, add the service.beta.kubernetes.io/do-loadbalancer-hostname annotation to the same service. Without it, in-cluster traffic to the load balancer’s external IP is short-circuited by kube-proxy and never traverses the load balancer, so the connection arrives at the NGINX Ingress Controller without a PROXY protocol header and the controller drops it.

   Follow the steps in Accessing by Hostname to create the DNS record and set the annotation. The resulting annotations section contains both annotations:

   apiVersion: v1
   kind: Service
   metadata:
   annotations:
       kubernetes.digitalocean.com/load-balancer-id: f55b4d90-your-load-balancer-id-4b1a29c40ff
       service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
       service.beta.kubernetes.io/do-loadbalancer-hostname: "your-hostname.example.com"
   labels:
       ...
   name: ingress-nginx-controller

Related Topics