About This Tool

Primary Use Case

Key Features

• Adds PROXY protocol support for internal cluster traffic to LoadBalancer services
• Solves ingress-nginx and cert-manager HTTP01 validation failures related to PROXY protocol
• Works out-of-the-box with ingress-nginx and cert-manager
• Preserves original client source IP addresses in proxied TCP connections
• Compatible with multiple cloud provider load balancers supporting PROXY protocol
• Mitigates Kubernetes kube-proxy iptables optimization issues with PROXY protocol

Insights & Recommendations

hairpin-proxy addresses a specific Kubernetes networking issue where kube-proxy redirects outbound traffic to the LoadBalancer's internal IP, causing PROXY protocol failures when accessed internally. It is recommended for users employing ingress-nginx with use-proxy-protocol enabled and cert-manager for ACME HTTP01 validation. Ensure your cloud load balancer supports the PROXY protocol and that both load balancer and web server are configured accordingly.

Installation

Run kubectl apply -f https://raw.githubusercontent.com/compumike/hairpin-proxy/v0.2.1/deploy.yml

Usage

Smart Usage Notes

• Integrate hairpin-proxy into Kubernetes ingress pipelines to ensure accurate client IP logging for better incident investigation.
• Use hairpin-proxy to improve cert-manager ACME HTTP01 challenge reliability, reducing downtime during certificate renewals.
• Combine with network monitoring tools to detect anomalous traffic patterns that could indicate lateral movement or proxy protocol misuse.
• Leverage hairpin-proxy in purple team exercises to simulate real-world ingress and proxy protocol evasion scenarios.
• Automate deployment of hairpin-proxy in DevSecOps pipelines to enforce consistent cloud load balancer configurations and reduce misconfigurations.

Security Capability Profile