New routing strategy: proxyProtocolAuthorityIdentifiesNode

[hrishabhg]

---

⚠️ Proposal Numbering

This PR contains proposal files that don't follow the expected format:

Issues found:

• proposals/017-proxy-protocol-authority-routing.md

Fix for proposals/017-proxy-protocol-authority-routing.md:

git mv proposals/017-proxy-protocol-authority-routing.md proposals/101-proxy-protocol-authority-routing.md
# Update title: remove any old number prefix and add PR number
sed -i.bak '0,/^# /{s/^# \([0-9]\{3\}\|xxx\|nnn\|000\) - /# 101 - /; t; s/^# /# 101 - /}' proposals/101-proxy-protocol-authority-routing.md && rm proposals/101-proxy-protocol-authority-routing.md.bak
git add proposals/101-proxy-protocol-authority-routing.md
git commit -m "Rename proposal to use PR number 101"
git push

Note: The commands above can be copied and pasted directly into your terminal. The sed command will automatically preserve your title text.

See proposals/README.md for the complete workflow.

[tombentley]

@hrishabhg thanks for this. The use case makes sense, and I think we should do this.

I would like to see some words calling out that when terminating TLS in NLB/HAProxy and using plain TCP for the connection to the Kroxylicious proxy instance(s) there is an assumption that the intermediate network is trusted. It's obvious, but should not be overlooked by people deploying the proxy, so we'll need to ensure that we have similar words in the docs too.

[robobario]

For the other strategies we support a convenience bootstrapAddress like:

  sniHostIdentifiesNode:
        bootstrapAddress: bootstrap.mycluster.example.com:9192 
        advertisedBrokerAddressPattern: mybroker-$(nodeId).mycluster.example.com:443

Kafka does not require this, but it can make client configuration more convenient.

Do we also want to support a convenience bootstrapAddress in this strategy? So that users might connect to the NLB with bootstrap.kafka.example.com and the Proxy can identify which gateway the incoming connection is associated with?

[robobario]

ah, yes in your POC example you have:

Kafka clients connecting via TLS to HAProxy with bootstrap server `bootstrap.kafka.example.com:49192` produced the following in Kroxylicious logs:

so I think the proxy will need to be aware of that host so it can route it to the right place. Maybe something like:

- name: via-nlb
        proxyProtocolAuthorityIdentifiesNode:
        bindAddress: 0.0.0.0:9192
        bootstrapHostname: bootstrap.kafka.example.com
        advertisedBrokerAddressPattern: broker-$(nodeId).kafka.example.com

[robobario]

Can multiple proxyProtocolAuthorityIdentifiesNode gateways share a port the same way we do for SNI? I imagine that they can.

[robobario]

Maybe we should set this to not affected and cover the operator in a separate proposal, going into detail here will add complexity to this design.

[k-wall]

Discussed at Community Call 23rd April. General feeling is that this is good idea.
@hrishabhg is looking for feedback.

[k-wall]

Hi! We've updated the proposal numbering system to use PR numbers as proposal identifiers.

Action required: Please rebase your PR on main.

Once you rebase, you'll need to rename your proposal file and update the title:

git mv proposals/017-proxy-protocol-authority-routing.md proposals/101-protocol-authority-routing.md
# Update title: remove any old number prefix and add PR number
sed -i.bak '0,/^# /{s/^# \([0-9]\{3\}\|xxx\|nnn\|000\) - /# 101 - /; t; s/^# /# 101 - /}' proposals/101-protocol-authority-routing.md && rm proposals/101-protocol-authority-routing.md.bak
git add proposals/101-protocol-authority-routing.md
git commit -m "Rename proposal to use PR number"
git push

The GitHub workflow will automatically check your proposal file naming after you push and update this PR description if any corrections are still needed.

See proposals/README.md for the updated workflow.

[k-wall]

Correction: The previous notification had an incorrect filename. Here are the correct commands:

git mv proposals/017-proxy-protocol-authority-routing.md proposals/101-proxy-protocol-authority-routing.md
# Update title: remove any old number prefix and add PR number
sed -i.bak '0,/^# /{s/^# \([0-9]\{3\}\|xxx\|nnn\|000\) - /# 101 - /; t; s/^# /# 101 - /}' proposals/101-proxy-protocol-authority-routing.md && rm proposals/101-proxy-protocol-authority-routing.md.bak
git add proposals/101-proxy-protocol-authority-routing.md
git commit -m "Rename proposal to use PR number"
git push

Sorry for the confusion!