Kubernetes - How to get client IP behind loadbalancer?

Viewed 1155

How get client IP from nginx ingress load blanacer? I've tried setting use proxy protocol and externalTrafficPolicy but still it doesn't show client IP.

Apache logs 10.0.0.225 for each http request. I'm not sure what IP that is, it doesn't seem to be pod's IP or node IP.

httpd service:

apiVersion: v1
kind: Service
metadata:
  name: httpd
  labels:
    app: httpd-service
  namespace: test-web-dev
spec:
  type: NodePort
  selector:
    app: httpd
  ports:
    - name: port-80
      port: 80
      protocol: TCP
      targetPort: 80
    - name: port-443
      port: 443
      protocol: TCP
      targetPort: 443
  sessionAffinity: "ClientIP"
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800
  externalTrafficPolicy: Local

ingress-lb:

apiVersion: v1
kind: ConfigMap
metadata:
  name: tcp-services
  namespace: ingress-nginx
data:
  use-proxy-protocol: 'true'
---
kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: https
      port: 443
      protocol: TCP
      targetPort: https

In Apache I've configured the following logging settings:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
CustomLog "logs/ssl_access_log" combined env=!forwarded
CustomLog "logs/ssl_access_log" proxy env=forwarded
1 Answers

You should get the origin IP in the X-Forwarded-For header, this is a default config for nginx-ingress: forwarded-for-header

This is configured in a ConfigMap

Related