From: Shubha Jain <SHUBHA.JAIN1@ibm.com>
Date: Tue, 6 Jan 2026 15:19:27 +0000 (+0530)
Subject: mgr/orchestrator: default NFS ingress to haproxy-protocol mode
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=4a64b83c6c5c7978764ad694da464e35b8d3d013;p=ceph.git

mgr/orchestrator: default NFS ingress to haproxy-protocol mode

Change default ingress mode from haproxy-standard to haproxy-protocol
to preserve client IP addresses for proper IP-level export restrictions
in NFS Ganesha.

Fixes: https://tracker.ceph.com/issues/74260

Signed-off-by: Shubha Jain <SHUBHA.JAIN1@ibm.com>
---

diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py
index 56d94fe24ab..5b8e9a6458f 100644
--- a/src/pybind/mgr/orchestrator/module.py
+++ b/src/pybind/mgr/orchestrator/module.py
@@ -222,7 +222,9 @@ class IngressType(enum.Enum):
 
     def canonicalize(self) -> "IngressType":
         if self == self.default:
-            return IngressType(self.haproxy_standard)
+            # Default to haproxy-protocol to preserve client IP addresses
+            # for proper IP-level export restrictions in NFS Ganesha
+            return IngressType(self.haproxy_protocol)
         return IngressType(self)
 
 
@@ -2623,3 +2625,4 @@ Usage:
         completion = self.update_service(service_type.value, service_type.name, image)
         raise_if_exception(completion)
         return HandleCommandResult(stdout=completion.result_str())
+