feat(gitlab-shell): add BackendTrafficPolicy for PROXY v2 with Envoy Gateway

Jason Plumrequested to merge
duo/feature/6588-shell-backendtrafficpolicy-proxy-protocol into master

What does this MR do?

When global.shell.tcp.proxyProtocol is true, Envoy Gateway is managed by the chart, and GitLab Shell can accept PROXY protocol on the backend connection, render a BackendTrafficPolicy targeting the gitlab-shell TCPRoute that instructs Envoy to send PROXY v2 headers on the backend connection to GitLab Shell.

Without this policy, Envoy opens a new TCP connection to GitLab Shell without forwarding the original client address, so GitLab Shell records the Envoy source address instead of the real client IP. This breaks auditability, rate limiting, and stricter proxyPolicy settings.

This is consistent with the existing Traefik and NGINX behaviour, which already forward PROXY protocol to GitLab Shell — Traefik gates its outbound leg on global.shell.tcp.proxyProtocol (services[].proxyProtocol.version: 2), and NGINX/HAProxy add the PROXY suffix to the TCP ConfigMap when the receiver is PROXY-capable. The BackendTrafficPolicy applies both checks.

The BackendTrafficPolicy is only rendered when:

  1. gitlab-shell is enabled
  2. Gateway API routing is enabled for gitlab-shell
  3. Envoy policies are managed by the chart (installEnvoy: true, same namespace)
  4. global.shell.tcp.proxyProtocol is true (the inbound leg is active, so Envoy has a real client address to forward) and GitLab Shell can accept PROXY v2 on the backend leg (such as config.proxyProtocol: true, or sshDaemon: gitlab-sshd with proxyPolicy other than reject)

Related issues

Closes #6588 (closed)

Author checklist

For general guidance, please follow our Contributing guide.

Required

For anything in this list which will not be completed, please provide a reason in the MR discussion.

  • Merge Request Title and Description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • MR has a green pipeline.
  • Documentation created/updated.
  • Tests added/updated.
  • Have you validated that your change works end-to-end on a real cluster deployment?
    • Describe how you did it in a comment.
  • Equivalent MR/issue for omnibus-gitlab opened.

Reviewers checklist

Edited by Jason Plum

Merge request reports