// Module included in the following assemblies:
//
// * networking/ingress-operator.adoc

:_mod-docs-content-type: PROCEDURE
[id="nw-ingress-controller-configuration-proxy-protocol_{context}"]
= Configuring the PROXY protocol for an Ingress Controller

A cluster administrator can configure link:https://www.haproxy.org/download/2.8/doc/proxy-protocol.txt[the PROXY protocol] when an Ingress Controller uses either the `HostNetwork`, `NodePortService`, or `Private` endpoint publishing strategy types. The PROXY protocol enables the load balancer to preserve the original client addresses for connections that the Ingress Controller receives. The original client addresses are useful for logging, filtering, and injecting HTTP headers. In the default configuration, the connections that the Ingress Controller receives only contain the source address that is associated with the load balancer.

[WARNING]
====
The default Ingress Controller with installer-provisioned clusters on non-cloud platforms that use a Keepalived Ingress Virtual IP (VIP) do not support the PROXY protocol.
====

The PROXY protocol enables the load balancer to preserve the original client addresses for connections that the Ingress Controller receives. The original client addresses are useful for logging, filtering, and injecting HTTP headers. In the default configuration, the connections that the Ingress Controller receives contain only the source IP address that is associated with the load balancer.

[IMPORTANT]
====
For a passthrough route configuration, servers in {product-title} clusters cannot observe the original client source IP address. If you need to know the original client source IP address, configure Ingress access logging for your Ingress Controller so that you can view the client source IP addresses.

For re-encrypt and edge routes, the {product-title} router sets the `Forwarded` and `X-Forwarded-For` headers so that application workloads check the client source IP address.

For more information about Ingress access logging, see "Configuring Ingress access logging".
====

Configuring the PROXY protocol for an Ingress Controller is not supported when using the `LoadBalancerService` endpoint publishing strategy type. This restriction is because when {product-title} runs in a cloud platform, and an Ingress Controller specifies that a service load balancer should be used, the Ingress Operator configures the load balancer service and enables the PROXY protocol based on the platform requirement for preserving source addresses.

[IMPORTANT]
====
You must configure both {product-title} and the external load balancer to use either the PROXY protocol or TCP.
====

This feature is not supported in cloud deployments. This restriction is because when {product-title} runs in a cloud platform, and an Ingress Controller specifies that a service load balancer should be used, the Ingress Operator configures the load balancer service and enables the PROXY protocol based on the platform requirement for preserving source addresses.

[IMPORTANT]
====
You must configure both {product-title} and the external load balancer to either use the PROXY protocol or to use Transmission Control Protocol (TCP).
====

.Prerequisites
* You created an Ingress Controller.

.Procedure
. Edit the Ingress Controller resource by entering the following command in your CLI:
+
[source,terminal]
----
$ oc -n openshift-ingress-operator edit ingresscontroller/default
----

. Set the PROXY configuration:
+
* If your Ingress Controller uses the `HostNetwork` endpoint publishing strategy type, set the `spec.endpointPublishingStrategy.hostNetwork.protocol` subfield to `PROXY`:
+
.Sample `hostNetwork` configuration to `PROXY`
[source,yaml]
----
# ...
  spec:
    endpointPublishingStrategy:
      hostNetwork:
        protocol: PROXY
      type: HostNetwork
# ...
----

* If your Ingress Controller uses the `NodePortService` endpoint publishing strategy type, set the `spec.endpointPublishingStrategy.nodePort.protocol` subfield to `PROXY`:
+
.Sample `nodePort` configuration to `PROXY`
[source,yaml]
----
# ...
  spec:
    endpointPublishingStrategy:
      nodePort:
        protocol: PROXY
      type: NodePortService
# ...
----

* If your Ingress Controller uses the `Private` endpoint publishing strategy type, set the `spec.endpointPublishingStrategy.private.protocol` subfield to `PROXY`:
+
.Sample `private` configuration to `PROXY`
[source,yaml]
----
# ...
  spec:
    endpointPublishingStrategy:
      private:
        protocol: PROXY
    type: Private
# ...
----
