I want to run an HTTP(S) proxy service in a GKE cluster, and take advantage of the existing Kubernetes ingress and the GCP load balancer to provide TLS termination and a stable public IP for the service. The clients would access the proxy via the public internet using basic auth.

So far I've run into three issues:

  1. It's tricky to configure an HTTP health check for the proxy, because the health check can only be configured with a relative path (e.g. GET /) and the proxy only responds to requests for fully qualified URLs (e.g. `GET http://www.example.com). I was able to work around this by modifying the (open source) proxy server implementation to add a health check at a relative URL.
  2. Similarly, the URL map requires a relative path, beginning with a '/'. I was able to work around this by specifying the proxy service as the default backend for the ingress, which is used if none of the host/path rules match.
  3. Here's where I'm stuck. The load balancer appears to strip the Proxy-Authorization header sent by the client. So when the requests arrive at the proxy server, they are missing the auth header, and fail with a 407 Proxy Authentication Required.

It's obviously not an option to disable authentication on the proxy. I haven't found any documentation acknowledging that the load balancer strips this header, or why it does so.


You are trying to use this type of balancer for something it isn't designed to do. GCP HTTP load balancers are reverse HTTP proxies -- they don't front-end for forward proxies. What you have working so far is essentially working by accident.

I'd suggest that your application actually needs a TCP load balancer rather than HTTP.


Yes HTTP(S) load balancer by default works with 4. But you can create a "User-defined request header". Please take a look to link1 and link2

  • It looks like user-defined request headers need to have a static value configured in the load balancer, so they couldn't be used for authentication. Or is there some way to define a header whose value is passed-through from the client request? – Matt Zimmerman Aug 6 '19 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.