How to retrieve the original IP from a HTTP request when using Cilium Gateway API on DOKS

Hi there,

I might be wrong, but this usually comes down to how traffic enters a DOKS cluster, not a Cilium or Gateway API issue.

By default, DigitalOcean load balancers do not preserve the client source IP. What reaches your Gateway is the node or proxy IP, which is why x-forwarded-for only contains a private address.

In practice, you have two options:

• Rely on X-Forwarded-For, but only if the load balancer is terminating HTTP(S) and adding it correctly.

• Enable PROXY protocol on the DigitalOcean load balancer and make sure your Cilium Gateway supports and parses it.

If PROXY protocol isn’t enabled or supported in your setup, you won’t be able to see the real client IP. I’d double-check the load balancer configuration and Cilium version, and if it’s still not working, opening a support ticket is probably the best way to confirm what’s supported today:

https://www.digitalocean.com/support/

Heya, @robinvanderknaap

If you need the true client IP, you generally have to enable PROXY protocol on the DigitalOcean Load Balancer and also enable PROXY protocol parsing on the Cilium Gateway listeners. DigitalOcean documents the LB side of this for ingress controllers, and Cilium has a Gateway API proxy-protocol toggle/flag for its Gateway listeners.

Without PROXY protocol (or some other source-IP preservation mechanism at the edge), there isn’t a magic header you can trust inside the pod — the gateway just never receives the original IP in the first place

Regards