From 4a64b83c6c5c7978764ad694da464e35b8d3d013 Mon Sep 17 00:00:00 2001 From: Shubha Jain Date: Tue, 6 Jan 2026 20:49:27 +0530 Subject: [PATCH] mgr/orchestrator: default NFS ingress to haproxy-protocol mode Change default ingress mode from haproxy-standard to haproxy-protocol to preserve client IP addresses for proper IP-level export restrictions in NFS Ganesha. Fixes: https://tracker.ceph.com/issues/74260 Signed-off-by: Shubha Jain --- src/pybind/mgr/orchestrator/module.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py index 56d94fe24ab..5b8e9a6458f 100644 --- a/src/pybind/mgr/orchestrator/module.py +++ b/src/pybind/mgr/orchestrator/module.py @@ -222,7 +222,9 @@ class IngressType(enum.Enum): def canonicalize(self) -> "IngressType": if self == self.default: - return IngressType(self.haproxy_standard) + # Default to haproxy-protocol to preserve client IP addresses + # for proper IP-level export restrictions in NFS Ganesha + return IngressType(self.haproxy_protocol) return IngressType(self) @@ -2623,3 +2625,4 @@ Usage: completion = self.update_service(service_type.value, service_type.name, image) raise_if_exception(completion) return HandleCommandResult(stdout=completion.result_str()) +