Question
Get client source IP with Kubernetes Load Balancer service
- Posted on November 4, 2018
- KubernetesLoad Balancing
Asked by zseguin
Hello,
I deployed Traefik to my Kubernetes cluster to act as an Ingress controller. On other clouds (e.g., Azure), you can set ‘External Traffic Policy’ to ‘Local’ in order to preserve the client source IP (https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip).
Does Digital Ocean plan on supporting this feature?
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Want to learn more? Join the DigitalOcean Community!
Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.
Hi!
This is how I managed to get this working: https://andrewmichaelsmith.com/2020/02/preserving-client-ip-in-kubernetes/
Digging more into it:
https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-type-loadbalancer
IIUC, this means that DO k8s load balancer doesn’t support the client source IP, as it uses the proxy (option 1) described in the link above. Moreover, the load balancer setting doesn’t seem to stick, so the HTTP headers solution isn’t feasible, and if you have a TCP service you have no support.
Correct me if I am wrong, but currently the source IP will be set to one of the nodes and there is no way to change that.
Ideally, DO should implement the option 2 (packet forwarder), as it would support this use case for people that need it (GCP and Azure do implement it).
Ditto; I’m toying with the idea of some non-HTTP apps that require client IP address information. Something like PROXY protocol would work in at least one case, but it would be simpler to have direct IP-level access to the client address.