How do I capture external I.P. address of end user on Voyager/HAProxy/Kubernetes?

2/4/2020

I would like to capture the external I.P. address of clients visiting my application. I am using kubernetes on AWS/Kops. The ingress set-up is Voyager configured HAProxy. I am using the LoadBalancer service.

I configured HAProxy through Voyager to add the x-forwarded-for header by using ingress.appscode.com/default-option: '{"forwardfor": "true"}' annotation.

The issue is that when I test the header is coming through with an internal I.P. address of one of my kubernetes nodes, rather than my external I.P. as desired.

I'm not sure what LoadBalancer voyager is using under the covers, there's no associated pod, just one for the ingress-controller.

kubectl describe svc voyager-my-app outputs

Name:                     <name>
Namespace:                <namespace>
Labels:                   origin=voyager
                          origin-api-group=voyager.appscode.com
                          origin-name=<origin-name>
Annotations:              ingress.appscode.com/last-applied-annotation-keys:
                          ingress.appscode.com/origin-api-schema: voyager.appscode.com/v1beta1
                          ingress.appscode.com/origin-name: <origin-name>
Selector:                 origin-api-group=voyager.appscode.com,origin-name=<origin-name>,origin=voyager
Type:                     LoadBalancer
IP:                       100.68.184.233
LoadBalancer Ingress:     <aws_url>
Port:                     tcp-443  443/TCP
TargetPort:               443/TCP
NodePort:                 tcp-443  32639/TCP
Endpoints:                100.96.3.204:443
Port:                     tcp-80  80/TCP
TargetPort:               80/TCP
NodePort:                 tcp-80  30263/TCP
Endpoints:                100.96.3.204:80
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>
-- James Render
haproxy-ingress
kubernetes-ingress

1 Answer

2/4/2020

Typically with Kubernetes ingresses, there are a couple relevant settings:

  • xff_num_trusted_hops, which specifies the number of hops that are "trusted" i.e., internal. This way you can distinguish between internal and external IP addresses.
  • You'll want to make sure you set ExternalTrafficPolicy: local in your load balancer (you didn't specify what your LB is)

Note I'm mostly familiar with Ambassador (built on Envoy Proxy) which does this by default.

-- Richard Li
Source: StackOverflow