Nginx-ingress - Wrong src client ip (X-Real-Ip)

7/30/2019

When using nginx-ingress in Kubernetes (installed via helm), the X-Real-Ip is not my real IP (not preserving the original client IP)

I've tried externalTrafficPolicy: "Local", use-proxy-protocol: "true" as suggested, but it didn't help...

-- Or Nahum
kubernetes
kubernetes-helm
nginx-ingress

1 Answer

12/12/2019

Can you provide us with more info, like the service you're using,

From a quick guess, Looks like you're applying the externalTrafficPolicy: "Local" on the wrong service,

I also previously applied it to my NodePort service instead of the Nginx Service and it didn't work

Please check the service with LoadBalancer type, it's usually named nginx-nginx-ingress-controller, a quick kubectl get services --all-namespaces can show you a list of all the services running.

TLDL

Local means that when the packet arrives to a pod, kube proxy will only distribute the load within the same node pods even though other pods in the same cluster are less loaded.

On the other hand, when setting Cluster value, the balancing takes into account not only the nodes but also the number of pods to distribute the requests, and to avoid imbalance, Kubernetes perform the balancing within the cluster.

https://medium.com/pablo-perez/k8s-externaltrafficpolicy-local-or-cluster-40b259a19404

https://github.com/jetstack/kube-lego/issues/57#issuecomment-277777686

-- Ceddy Muhoza
Source: StackOverflow