Get client source IP with Kubernetes Load Balancer service

Posted November 4, 2018 17.6k views
Load BalancingKubernetes


I deployed Traefik to my Kubernetes cluster to act as an Ingress controller. On other clouds (e.g., Azure), you can set ‘External Traffic Policy’ to 'Local’ in order to preserve the client source IP (

Does Digital Ocean plan on supporting this feature?

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
13 answers

Ditto; I’m toying with the idea of some non-HTTP apps that require client IP address information. Something like PROXY protocol would work in at least one case, but it would be simpler to have direct IP-level access to the client address.

I desperately need this as I’m basically ready to launch but can’t without getting the client IP from the load balancer.

Digging more into it:

IIUC, this means that DO k8s load balancer doesn’t support the client source IP, as it uses the proxy (option 1) described in the link above. Moreover, the load balancer setting doesn’t seem to stick, so the HTTP headers solution isn’t feasible, and if you have a TCP service you have no support.

Correct me if I am wrong, but currently the source IP will be set to one of the nodes and there is no way to change that.

Ideally, DO should implement the option 2 (packet forwarder), as it would support this use case for people that need it (GCP and Azure do implement it).

Hi @jkwiatkoski

This is the basic need for any websites and should be take it into highest priority. As I see that issue is reported in 2019 and it is still open. I am just thinking what should be priority means for DO?

  • Thank you for this feedback I will re-surfacce this to the LB team. Feel free to head over to and add/upvote this idea for prioritization

We definitely need to have an option to set externaTrafficPolicy to local in order to fail the health check on all Droplets that don’t match the service selector. This will fix this issue. I hope DO implements this soon.

Any update on this? We are also trying to get the client ip address.

Seemingly same issue here.

Same issue here. It’s really a bummer not being supported by DO

Also same issue here.


My workaround is to set up haproxy (or nginx) on a droplet (external to the kubernetes cluster) which adds the source IP to the X-Forwarded-For header and places the kubernetes load balancer in the backend.

haproxy: option forwardfor

nginx: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

Then your web app can get the source IP from the X-Forwarded-For header.

Of course, this is a last resort :(

Previous 1 2 Next