## Summary When Gateway API is used with Envoy Gateway and PROXY protocol is enabled for GitLab Shell, the chart renders the GitLab Shell `TCPRoute` but does not render an Envoy `BackendTrafficPolicy` that sends PROXY protocol to the GitLab Shell backend. The Gateway-level `ClientTrafficPolicy` can decode a PROXY v2 header received from a cloud LoadBalancer, but Envoy opens a new TCP connection to GitLab Shell. The original client address is therefore not propagated on that second hop unless a `BackendTrafficPolicy` with `proxyProtocol.version: V2` targets the generated `TCPRoute`. This creates a provider parity gap: the Traefik template already uses `global.shell.tcp.proxyProtocol` to configure `services[].proxyProtocol.version: 2`, while the Envoy Gateway path does not use that value. ## Steps to reproduce 1. Enable Gateway API with Envoy Gateway. 2. Enable PROXY protocol for the LoadBalancer-to-Envoy and Envoy-to-GitLab-Shell path. 3. Render chart `10.2.0` or current `master`. 4. Inspect the rendered `TCPRoute` and `BackendTrafficPolicy` resources. For example: ```shell helm template gitlab gitlab/gitlab \ --version 10.2.0 \ --values values.yaml \ | yq 'select(.kind == "TCPRoute" or .kind == "BackendTrafficPolicy")' ``` The chart renders the GitLab Shell `TCPRoute`. The only chart-generated `BackendTrafficPolicy` is the KAS policy; no policy targets the GitLab Shell `TCPRoute`. When SSH traffic is sent through a PROXY-enabled cloud LoadBalancer and Envoy Gateway, GitLab Shell sees the Envoy source address unless the missing policy is applied separately. ## Configuration used ```yaml global: gatewayApi: enabled: true installEnvoy: true shell: tcp: proxyProtocol: true gitlab: gitlab-shell: sshDaemon: gitlab-sshd config: proxyProtocol: true proxyPolicy: use gatewayApiResources: envoy: clientTrafficPolicySpec: proxyProtocol: {} ``` The LoadBalancer is independently configured to send PROXY v2 to Envoy. ## Current behavior The chart configures the two endpoints but not the sender on the backend connection: - `gatewayApiResources.envoy.clientTrafficPolicySpec.proxyProtocol` configures Envoy to decode PROXY protocol received from the LoadBalancer. - `gitlab.gitlab-shell.config.proxyProtocol` configures `gitlab-sshd` to receive PROXY protocol. - `global.shell.tcp.proxyProtocol` configures backend PROXY protocol for the legacy NGINX/Traefik paths. - The Gateway API GitLab Shell template renders only a plain `TCPRoute`; it does not configure Envoy to send a PROXY header to GitLab Shell. With `proxyPolicy: use`, SSH can continue to work but GitLab Shell records the Envoy address instead of the original client address. This affects auditability, security controls, rate limiting, and troubleshooting. A stricter receiver policy can reject the connection entirely. The required external workaround is: ```yaml apiVersion: gateway.envoyproxy.io/v1alpha1 kind: BackendTrafficPolicy metadata: name: gitlab-gitlab-shell-proxy-protocol spec: targetRefs: - group: gateway.networking.k8s.io kind: TCPRoute name: gitlab-gitlab-shell proxyProtocol: version: V2 ``` ## Expected behavior When the chart manages Envoy policies and `global.shell.tcp.proxyProtocol` is `true`, it should render an Envoy `BackendTrafficPolicy` that: - Targets the chart-generated GitLab Shell `TCPRoute`. - Sets `spec.proxyProtocol.version` to `V2`. - Is not rendered when PROXY protocol is disabled or Envoy policies are not managed by the chart. - Has Helm template tests covering enabled and disabled configurations. The Gateway API documentation should also distinguish the incoming LoadBalancer-to-Envoy `ClientTrafficPolicy` from the outgoing Envoy-to-GitLab-Shell `BackendTrafficPolicy`. Relevant existing behavior and history: - The current GitLab Shell `TCPRoute` template only renders `parentRefs` and `backendRefs`: https://gitlab.com/gitlab-org/charts/gitlab/-/blob/master/charts/gitlab/charts/gitlab-shell/templates/tcproute.yaml - The Traefik template already sends PROXY v2 when `global.shell.tcp.proxyProtocol` is enabled: https://gitlab.com/gitlab-org/charts/gitlab/-/blob/master/charts/gitlab/charts/gitlab-shell/templates/traefik-tcp-ingressroute.yaml - Gateway API support was introduced by https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4637 and tracked by https://gitlab.com/gitlab-org/charts/gitlab/-/work_items/5563. - Receiver-side `gitlab-sshd` support was tracked separately by https://gitlab.com/gitlab-org/charts/gitlab/-/work_items/2933. ## Versions - Chart: `10.2.0` and current `master` (`c6be09ed628c1872f936d6ed180458be5cef0bda`) - Envoy Gateway: `1.8.2` - Envoy Proxy: `1.38.3` - Platform: - Cloud: OVH Managed Kubernetes / OpenStack Octavia - Kubernetes: - Client: `v1.36.2` - Server: `v1.35.2` - Helm: - Client: `v4.1.4` ## Relevant logs There is no controller error: the rendered resources are valid, but the backend policy is absent. After applying the workaround above, Envoy Gateway accepts the policy and GitLab Shell receives the original SSH client address through PROXY v2. <!-- template sourced from https://gitlab.com/gitlab-org/charts/gitlab/-/blob/master/.gitlab/issue_templates/default.md -->