<p>I am trying to figure out how to enable the proxy protocol header in GKE.</p>
<p>Usually, you can do it with gcloud:</p>
<pre><code>gcloud compute target-ssl-proxies update my-ssl-lb-target-proxy \
    --proxy-header=PROXY_V1
</code></pre>
<p><a href="https://cloud.google.com/load-balancing/docs/tcp/setting-up-tcp#update_proxy_protocol_header_for_target_tcp_proxy" rel="nofollow noreferrer">https://cloud.google.com/load-balancing/docs/tcp/setting-up-tcp#update_proxy_protocol_header_for_target_tcp_proxy</a></p>
<p>But GKE doesn't list it up as annotation:</p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/service-parameters" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/service-parameters</a></p>
<p>Isn't there any support yet? :(</p>
<p>Thanks</p>

<p>When you create a Service of type &quot;LoadBalancer&quot; in GKE, it uses a <a href="https://cloud.google.com/load-balancing/docs/network" rel="nofollow noreferrer">Network Load Balancer</a> for external services and an <a href="https://cloud.google.com/load-balancing/docs/internal" rel="nofollow noreferrer">Internal TCP/UDP Load Balancer</a> for internal services.</p>
<p>You can use TCP and/or SSL Proxy load balancers as well, but it involves a bit of manual configuration.  You will need to create a <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/standalone-neg#how_to" rel="nofollow noreferrer">Standalone NEG</a> and then associate that as the backend of a TCP or SSL Proxy LB.</p>
<p>To create a Standalone NEG, you create a Service of type ClusterIP and use a neg annotation:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: neg-demo-svc
  annotations:
    cloud.google.com/neg: '{&quot;exposed_ports&quot;: {&quot;80&quot;:{&quot;name&quot;: &quot;NEG_NAME&quot;}}}'
spec:
  type: ClusterIP
  selector:
    run: neg-demo-app # Selects Pods labelled run: neg-demo-app
  ports:
  - port: 80
    protocol: TCP
    targetPort: 9376
</code></pre>
<p>You'd then associate the NEG with the backend service used by your TCP or SSL Proxy LB, for example</p>
<pre><code>gcloud compute backend-services add-backend my-bes \
    --global \
    --network-endpoint-group=NEG_NAME
    ...
</code></pre>
