Invalid configuration generated with using protocol `HTTPSPROXY`

When enabling protocol HTTPSPROXY generated configuration results in the following error when connecting via TLS:

error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number

This is a result of the proxyProtocolStack being set to [ “TLS”, “PROXY”, “HTTP”, “TCP” ], so TLS wrapping proxy wrapping HTTP wrapping TCP.

To Reproduce

Create a listener as such:

apiVersion: getambassador.io/v3alpha1
kind: Listener
metadata:
  name: http
  namespace: emissary
spec:
  port: 8443
  protocol: HTTPSPROXY
  securityModel: SECURE
  l7Depth: 0
  hostBinding:
    namespace:
      from: SELF

If using AWS NLB enable proxy protocol by setting the following annotation:

service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"

When attempting to connect to Emissary via https you will receive error error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number. Steps to reproduce the behavior:

Expected behavior

With proxy protocol enabled at the NLB and configured via protocol HTTPSPROXY a successful connection should be established.

Versions (please complete the following information):

• Ambassador: 2.2.2
• Kubernetes environment: AWS EKS 1.21

[alexgervais]

Thanks for the contribution @cyrus-mc ! I’ve assigned the PR review to a maintainer and will rely on the test automation to catch regressions.

[cyrus-mc]

Reading the RFC

In both cases, the protocol simply consists in an easily parsable header placed by the connection initiator at the beginning of each connection

This to me seems to indicate that proxy wrapping TLS is the correct order and any other LB that differ from that are the one offs. So at the very least I think the default for HTTPSPROXY should be as noted here and updated in the PR.