{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/51014","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/51014/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/51014/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/51014/events","html_url":"https://github.com/kubernetes/kubernetes/issues/51014","id":251622634,"number":51014,"title":"client_address is 10.* despite externalTrafficPolicy: Local","user":{"login":"kachkaev","id":608862,"avatar_url":"https://avatars3.githubusercontent.com/u/608862?v=4","gravatar_id":"","url":"https://api.github.com/users/kachkaev","html_url":"https://github.com/kachkaev","followers_url":"https://api.github.com/users/kachkaev/followers","following_url":"https://api.github.com/users/kachkaev/following{/other_user}","gists_url":"https://api.github.com/users/kachkaev/gists{/gist_id}","starred_url":"https://api.github.com/users/kachkaev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kachkaev/subscriptions","organizations_url":"https://api.github.com/users/kachkaev/orgs","repos_url":"https://api.github.com/users/kachkaev/repos","events_url":"https://api.github.com/users/kachkaev/events{/privacy}","received_events_url":"https://api.github.com/users/kachkaev/received_events","type":"User","site_admin":false},"labels":[{"id":617149945,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-sig","name":"needs-sig","color":"ededed","default":false},{"id":116712108,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/network","name":"sig/network","color":"d2b48c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-08-21T10:55:29Z","updated_at":"2017-08-22T17:20:33Z","closed_at":null,"body":"**Is this a BUG REPORT or FEATURE REQUEST?**:\r\n\r\n/kind bug\r\n\r\n(or a missing note / caveat in https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip)\r\n\r\n**What happened**:\r\n\r\nI noticed that my ingress controller (traefik) was providing wrong values for the `X-Forwarded-For` HTTP header. It turned out that even when traefik was bypassed, I was not able to see a real remote client IP in the HTTP headers. Running `gcr.io/google_containers/echoserver:1.8` as a NodePort or LoadBalancer service consistently reported `client_address=10.32.0.1` in the requests (same as `X-Forwarded-For` assigned by traefik earlier).\r\n\r\nI read [Using Source IP](https://kubernetes.io/docs/tutorials/services/source-ip/), which suggested that such a problem could exist in multi-node clusters. Setting `externalTrafficPolicy: Local` for a service of type `NodePort` or `LoadBalancer` was supposed to be a cure, however, this did not help me unfortunately. Even a diligent repetition of all the steps mentioned in the topic did not allow me to see a real remote IP address.\r\n\r\nMy k8s cluster is supersimple – it has been created with kubeadm and sits in a single public-facing KVM. I've been using docker on the same machines previously and never had issues with figuring out a remote IP inside the containers. Maybe the issue is somehow related to the weave network that I'm using or there is something else with the setup that breaks the expected behavior?\r\n\r\nWhat can you guys suggest?\r\n\r\n**What you expected to happen**:\r\n\r\nI expected `remote_address` to be equal ty my client's IP address, i.e. the same one I see when `tcpdump -nnn -i any port $SERVICEPORT` on the server.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\n\r\n\r\n**Anything else we need to know?**:\r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`):\r\n\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"7\", GitVersion:\"v1.7.4\", GitCommit:\"793658f2d7ca7f064d2bdf606519f9fe1229c381\", GitTreeState:\"clean\", BuildDate:\"201\r\n7-08-17T17:03:51Z\", GoVersion:\"go1.8.3\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"7\", GitVersion:\"v1.7.2\", GitCommit:\"922a86cfcd65915a9b2f69f3f193b8907d741d9c\", GitTreeState:\"clean\", BuildDate:\"201\r\n7-07-21T08:08:00Z\", GoVersion:\"go1.8.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n- Cloud provider or hardware configuration**:\r\n\r\nA single-node cluster (Ubuntu KVM) at https://firstvds.ru/\r\n\r\n- OS (e.g. from /etc/os-release):\r\n\r\n```\r\nNAME=\"Ubuntu\"\r\nVERSION=\"16.04.2 LTS (Xenial Xerus)\"\r\nID=ubuntu\r\nID_LIKE=debian\r\nPRETTY_NAME=\"Ubuntu 16.04.2 LTS\"\r\nVERSION_ID=\"16.04\"\r\nHOME_URL=\"http://www.ubuntu.com/\"\r\nSUPPORT_URL=\"http://help.ubuntu.com/\"\r\nBUG_REPORT_URL=\"http://bugs.launchpad.net/ubuntu/\"\r\nVERSION_CODENAME=xenial\r\nUBUNTU_CODENAME=xenial\r\n```\r\n\r\n- Kernel (e.g. `uname -a`):\r\n\r\n```\r\n4.4.0-83-generic\r\n```\r\n\r\n- Install tools:\r\n\r\n```\r\nkubeadm\r\n```\r\n\r\n- Others:\r\n\r\n Using weave as a pod network. `ps aux | grep -F 10.32` returns:\r\n\r\n```\r\n/home/weave/weaver\r\n--port=6783\r\n--datapath=datapath\r\n--host-root=/host\r\n--http-addr=127.0.0.1:6784\r\n--status-addr=0.0.0.0:6782\r\n--docker-api=\r\n--no-dns\r\n--db-prefix=/weavedb/weave-net\r\n--ipalloc-range=10.32.0.0/12                       <----\r\n--nickname=kachkaev\r\n--ipalloc-init consensus=1\r\n--conn-limit=30\r\n--expect-npc 91.240.87.56\r\n```\r\n\r\n`ps aux | grep api`\r\n\r\n```\r\nkube-apiserver \r\n--service-node-port-range=80-10000 \r\n--experimental-bootstrap-token-auth=true \r\n--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname \r\n--requestheader-group-headers=X-Remote-Group \r\n--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt \r\n--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key \r\n--proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key \r\n--insecure-port=0 \r\n--requestheader-username-headers=X-Remote-User \r\n--requestheader-allowed-names=front-proxy-client \r\n--service-account-key-file=/etc/kubernetes/pki/sa.pub \r\n--client-ca-file=/etc/kubernetes/pki/ca.crt \r\n--allow-privileged=true \r\n--service-cluster-ip-range=10.96.0.0/12 \r\n--secure-port=16443 \r\n--requestheader-extra-headers-prefix=X-Remote-Extra- \r\n--tls-cert-file=/etc/kubernetes/pki/apiserver.crt \r\n--tls-private-key-file=/etc/kubernetes/pki/apiserver.key \r\n--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt \r\n--proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt \r\n--admission-control=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota \r\n--authorization-mode=Node,RBAC \r\n--advertise-address=42.42.42.42 \r\n--etcd-servers=http://127.0.0.1:2379\r\n```"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/324094370","html_url":"https://github.com/kubernetes/kubernetes/issues/51014#issuecomment-324094370","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/51014","id":324094370,"user":{"login":"kachkaev","id":608862,"avatar_url":"https://avatars3.githubusercontent.com/u/608862?v=4","gravatar_id":"","url":"https://api.github.com/users/kachkaev","html_url":"https://github.com/kachkaev","followers_url":"https://api.github.com/users/kachkaev/followers","following_url":"https://api.github.com/users/kachkaev/following{/other_user}","gists_url":"https://api.github.com/users/kachkaev/gists{/gist_id}","starred_url":"https://api.github.com/users/kachkaev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kachkaev/subscriptions","organizations_url":"https://api.github.com/users/kachkaev/orgs","repos_url":"https://api.github.com/users/kachkaev/repos","events_url":"https://api.github.com/users/kachkaev/events{/privacy}","received_events_url":"https://api.github.com/users/kachkaev/received_events","type":"User","site_admin":false},"created_at":"2017-08-22T17:20:33Z","updated_at":"2017-08-22T17:20:33Z","body":"/sig network"}}
{"actor":{"display_login":"kachkaev"}}