Issue Nginx Load Balancer Proxy

[jonas-tm]

I am currently evaluating hetzner-k3s for a future project and span up a simple cluster.
However, I am struggling to get Ingress Nginx working correctly. For every Ingress I set up nginx is just returning 400 Bad Request.

I installed Ingress Nginx via Helm (Chart Version 4.5.2) in namespace ingress-nginx. LB was correctly created in HCLOUD and I pointed "domain-pointing-to-lb.com" to the IPv4 of the LB.

NGINX Ingress controller
Release: v1.6.4
Build: 69e8833858fb6bda12a44990f1d5eaa7b13f4b75
Repository: https://github.com/kubernetes/ingress-nginx
nginx version: nginx/1.21.6

With the following values set:

  controller:
  service:
    annotations:
      load-balancer.hetzner.cloud/location: ash
      load-balancer.hetzner.cloud/name: ingress-nginx-services
      load-balancer.hetzner.cloud/type: lb11
      load-balancer.hetzner.cloud/hostname: domain-pointing-to-lb.com
      load-balancer.hetzner.cloud/http-redirect-https: 'false'
      load-balancer.hetzner.cloud/uses-proxyprotocol: 'true'
      load-balancer.hetzner.cloud/use-private-ip: 'true'
  replicaCount: 2

Sample Ingress Config:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-test
  namespace: ingress-nginx
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
    - host: domain-pointing-to-lb.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ingress-nginx-controller
                port:
                  number: 80

Applied hetzner-k3 config

# ...
k3s_version: v1.25.5+k3s1
use_ssh_agent: false
ssh_allowed_networks:
  - 0.0.0.0/0
api_allowed_networks:
  - 0.0.0.0/0
private_network_subnet: 10.0.0.0/16
schedule_workloads_on_masters: false
masters_pool:
 # ...
worker_node_pools:
 # ...

When using cert-manager I run into the same problem as the temporary ingress created for a domain is also not reachable (nginx 400 Bad Request).

Am I missing a configuration or is something off with my setup?

[vitobotta]

The annotation load-balancer.hetzner.cloud/uses-proxyprotocol: 'true' enables the proxy protocol on the load balancer, so you need to enable it also in the Nginx configmap otherwise Nginx won't udnerstand requests coming from the load balancer and you'll get a 400. So you need to edit the configmap created in the ingress nginx namespace and add the setting use-proxy-protocol: "true". Hope this helps

[jonas-tm]

@vitobotta Thanks a lot for the super fast reply and of course for building this awesome tool!
This was exactly the issue. For anyone else landing here using the Helm Chart here is the working values yaml:

  controller:
  service:
    annotations:
      load-balancer.hetzner.cloud/location: ash
      load-balancer.hetzner.cloud/name: ingress-nginx-services
      load-balancer.hetzner.cloud/type: lb11
      load-balancer.hetzner.cloud/hostname: domain-pointing-to-lb.com
      load-balancer.hetzner.cloud/http-redirect-https: 'false'
      load-balancer.hetzner.cloud/uses-proxyprotocol: 'true'
      load-balancer.hetzner.cloud/use-private-ip: 'true'
  replicaCount: 2
  config:
    use-proxy-protocol: "true"

[vitobotta]

You're welcome :)

[creib]

Great, I spent quite some time on exactly this problem today. Thanks a lot!