New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Src/dst same node nlb with TLS termination #724

Open

szuecs opened this issue Oct 13, 2024 · 1 comment

Labels

bugfix

Member

szuecs commented Oct 13, 2024

This with ip preservation normally leads to shortcircuit in kernel with src writing TLS and dst reading plain text and replying plain text but kernel doesn't know about TLS server side so protocol confusion .
Maybe https://github.com/kubernetes/enhancements/tree/master/keps/sig-network/1860-kube-proxy-IP-node-binding solves the problem and sig-network slack https://kubernetes.slack.com/archives/C09QYUH5W/p1728654443481729 discuss if it is a possible fix.

szuecs added the bugfix label

Member

AlexanderYastrebov commented Oct 14, 2024

Another option is to implement PROXY protocol supported by NLB.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment