Add upstream and downstream support for the PROXY protocol on TransportServer

[moo1210]

Proposed changes

This PR adds upstream and downstream support for the PROXY protocol to TransportServer

Current behavior and limitations:

• TransportServers with custom listeners will never use the PROXY protocol downstream

  kubernetes-ingress/internal/configs/version2/template_helper.go

  Line 190 in e070aca

  proxyProtocol: false,

• TransportServers cannot use the PROXY protocol upstream (without custom snippets)

These limitations are unblocked by:

• proxyProtocol is added to upstreamParameters in the TransportServer CRD.
  • Resolves Unable to set proxy_protocol for TransportServer #8122
• PROXY protocol is added as an available protocol to listener configuration in the TransportServer and GlobalConfiguration CRDs.

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• I have updated necessary documentation
• I have rebased my branch onto main
• I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

[github-actions]

✅ All required contributors have signed the F5 CLA for this PR. Thank you!
_{Posted by the CLA Assistant Lite bot.}

[moo1210]

I have hereby read the F5 CLA and agree to its terms

[Copilot]

Pull request overview

This PR extends TransportServer to support the PROXY protocol both downstream (accepting PROXY headers on the listener) and upstream (sending PROXY headers to upstreams), addressing current limitations around custom listeners and upstream configuration.

Changes:

• Add upstreamParameters.proxyProtocol to enable upstream PROXY protocol (proxy_protocol on;) in TransportServer stream server blocks.
• Add PROXY as a valid listener protocol and generate listen ... proxy_protocol; for TransportServer listeners.
• Update CRD schemas/docs and add tests covering PROXY listener + upstream behavior.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/client/applyconfiguration/configuration/v1/upstreamparameters.go	Adds apply-config field for proxyProtocol in upstream parameters.
pkg/apis/configuration/validation/globalconfiguration.go	Allows PROXY as a valid protocol and updates port/protocol conflict logic.
pkg/apis/configuration/v1/types.go	Adds ProxyProtocol to the UpstreamParameters API type.
internal/configs/version2/template_helper.go	Enables downstream PROXY protocol in generated transport listen directives.
internal/configs/version2/template_helper_test.go	Adds unit coverage for listen ... proxy_protocol; generation.
internal/configs/version2/stream.go	Extends StreamServer with upstream/downstream PROXY protocol flags.
internal/configs/version2/nginx.transportserver.tmpl	Emits proxy_protocol on; when upstream PROXY is enabled.
internal/configs/version2/nginx-plus.transportserver.tmpl	Emits proxy_protocol on; when upstream PROXY is enabled (Plus template).
internal/configs/transportserver.go	Wires listener protocol and upstreamParameters into StreamServer config flags.
internal/configs/transportserver_test.go	Adds config-generation test for listener.protocol: PROXY + upstream proxyProtocol.
docs/crd/k8s.nginx.org_transportservers.md	Documents upstreamParameters.proxyProtocol.
deploy/crds.yaml	Adds proxyProtocol to generated CRD YAML (deploy bundle).
config/crd/bases/k8s.nginx.org_transportservers.yaml	Adds proxyProtocol to the CRD base for TransportServers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This doc update adds upstreamParameters.proxyProtocol, but the TransportServer also now supports listener.protocol: PROXY for downstream PROXY protocol. Consider updating the listener.protocol row to document the accepted values (including PROXY) so users can discover the new listener option from the CRD docs.

[moo1210]

The listener.protocol row makes no mention of TCP or UDP, so adding PROXY to the docs there seems outside the scope of this PR.

[Copilot]

Introducing listener.protocol: PROXY makes the protocol space no longer just TCP vs UDP. There are existing code paths that treat anything other than "TCP" as UDP (for example, TransportServer metrics in internal/k8s/configuration.go increments TotalUDP in the else branch), which will misclassify PROXY TransportServers. Update those call sites to treat "PROXY" as TCP (or add a dedicated counter) and adjust tests accordingly.

[AlexFenlon]

Hey @moo1210 , thanks for making this.

Seems like a lot of work, thank you! Once the team has time, we can review this and get back to you. Thanks!