Does Nginx Gateway Fabric support "use-cluster-ip: true" for TCP and UDP traffic?

[Nikoolayy1]

I see that this is supported for Nginx Ingress VirtualServer CRD but not TransportServer CRD as I mentioned in nginx/kubernetes-ingress#8776 , so I wanted to check here for TCP/UDP or TLS passthrough if it is supported in the k8s gateway,

[bjee19]

Hey @Nikoolayy1, currently NGINX Gateway Fabric does not support sending traffic to a Kubernetes Service's clusterIP. However, if you'd like to see that implemented, you can feel free to open up and issue describing your use case!

[Nikoolayy1]

Hey @bjee19 a use case is when you have F5 BIG-IP and CIS and the Nginx Ingress or Gateway Fabric is just as a layer 3 entry and the k8s service is with internaltrafficpolicy set to Local this way Nginx will contact only app pods on the same node and F5 with HTTP/HTTPS health monitors will know which nodes have the app pods through the nginx gateway fabric.

The fabric is deployed in daemonset. If the use-cluster-ip: true is not enabled then the internaltrafficpolicy set to Local does not take effect at all. I tested this with VirtualServer CRD and that supports it and it works https://my.f5.com/manage/s/article/K000092470 but Nginx Ingress does not support this for TransportServer and there is no SSL passthrough.

[bjee19]

Ok great, I'll bring this back to the team and we'll discuss it in our community meeting on tuesday. Depending on the outcome, i'll open up an issue to track this use case and/or i'll respond here with our plans moving forwards on this.

[Nikoolayy1]

@bjee19 Thanks! As Gateway Fabric will at some point replace Ingress I think this option in Nginx that is already there will be great to be exposed for all gateway resources TCP/TLS/HTTP/UDP not like Nginx Ingress just for the VirtualServer CRD and not for the other CRD like TransportServer.

[Nikoolayy1]

@bjee19 forgot to add one more use case integrating with service meshes like linkerd https://docs.nginx.com/nginx-ingress-controller/tutorials/nginx-ingress-linkerd/ as even the nginx article mentions to use this option for Nginx Ingress.

[bjee19]

Hey @Nikoolayy1, brought this back to the team and we're thinking about opening up a tracking issue, but would like to get just a little more information on the initial use case with F5 BIG-IP and CIS with NGF.

Regarding this chunk:

Gateway Fabric is just as a layer 3 entry and the k8s service is with internaltrafficpolicy set to Local this way Nginx will contact only app pods on the same node and F5 with HTTP/HTTPS health monitors will know which nodes have the app pods through the nginx gateway fabric.

Is the main ask here to support k8s services with internaltrafficpolicy set to Local?

I'm not too sure how this last part will work:

F5 with HTTP/HTTPS health monitors will know which nodes have the app pods through the nginx gateway fabric.

If the NGINX Pod NGF spins up is on a different node than the app pods with k8s services with internaltrafficpolicy set to local, won't traffic not flow? I'm not sure what purpose this setup would serve.