{"action":"created","issue":{"url":"https://api.github.com/repos/istio/istio/issues/3059","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/3059/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/3059/comments","events_url":"https://api.github.com/repos/istio/istio/issues/3059/events","html_url":"https://github.com/istio/istio/issues/3059","id":293602299,"number":3059,"title":"Envoy masking client IP","user":{"login":"Stono","id":1486729,"avatar_url":"https://avatars2.githubusercontent.com/u/1486729?v=4","gravatar_id":"","url":"https://api.github.com/users/Stono","html_url":"https://github.com/Stono","followers_url":"https://api.github.com/users/Stono/followers","following_url":"https://api.github.com/users/Stono/following{/other_user}","gists_url":"https://api.github.com/users/Stono/gists{/gist_id}","starred_url":"https://api.github.com/users/Stono/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Stono/subscriptions","organizations_url":"https://api.github.com/users/Stono/orgs","repos_url":"https://api.github.com/users/Stono/repos","events_url":"https://api.github.com/users/Stono/events{/privacy}","received_events_url":"https://api.github.com/users/Stono/received_events","type":"User","site_admin":false},"labels":[{"id":735781806,"url":"https://api.github.com/repos/istio/istio/labels/area/networking","name":"area/networking","color":"0e8a16","default":false},{"id":822212191,"url":"https://api.github.com/repos/istio/istio/labels/kind/customer%20issue","name":"kind/customer issue","color":"fbca04","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":29,"created_at":"2018-02-01T16:46:21Z","updated_at":"2018-03-14T17:37:09Z","closed_at":"2018-02-15T09:19:03Z","author_association":"CONTRIBUTOR","body":"Hey, \r\nI am using `ingress-nginx` in my cluster, however it seems to be seeing all incoming requests from the client ip of `127.0.0.1`\r\n\r\n```\r\n127.0.0.1 - [127.0.0.1] - - [01/Feb/2018:16:38:25 +0000]\r\n```\r\n\r\nI've double checked my service, and it's set to `externalTrafficPolicy: Local` which should [preserve the client ip](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) but it is not.\r\n\r\nI tested removing envoy and just using ingress-nginx alone, and the client ip is correct, therefore it leads me to believe that for whatever reason, we're losing that information because of envoy.\r\n\r\nLooking in the istio-proxy logs, it also shows 127.0.0.1:\r\n\r\n```\r\n[2018-02-01T16:49:52.335Z] \"GET / HTTP/1.1\" 200 - 0 116763 251 246 \"127.0.0.1\"\r\n```\r\n\r\nWe use `ingress-nginx` for modsecurity/openwaf, so knowing that client ip is very important!  Any tips as to how we can get envoy to preserve it?\r\n\r\nFor context, we're on GKE, kubernetes 1.8.6 and istio 0.4.0"},"comment":{"url":"https://api.github.com/repos/istio/istio/issues/comments/373110431","html_url":"https://github.com/istio/istio/issues/3059#issuecomment-373110431","issue_url":"https://api.github.com/repos/istio/istio/issues/3059","id":373110431,"user":{"login":"Stono","id":1486729,"avatar_url":"https://avatars2.githubusercontent.com/u/1486729?v=4","gravatar_id":"","url":"https://api.github.com/users/Stono","html_url":"https://github.com/Stono","followers_url":"https://api.github.com/users/Stono/followers","following_url":"https://api.github.com/users/Stono/following{/other_user}","gists_url":"https://api.github.com/users/Stono/gists{/gist_id}","starred_url":"https://api.github.com/users/Stono/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Stono/subscriptions","organizations_url":"https://api.github.com/users/Stono/orgs","repos_url":"https://api.github.com/users/Stono/repos","events_url":"https://api.github.com/users/Stono/events{/privacy}","received_events_url":"https://api.github.com/users/Stono/received_events","type":"User","site_admin":false},"created_at":"2018-03-14T17:37:09Z","updated_at":"2018-03-14T17:37:09Z","author_association":"CONTRIBUTOR","body":"Added complexity.  The solution I have now means I have a single point in which all traffic passes through and that is nginx, a tool that is proven and tested and established for being a scalable ingress point for traffic.  We also have organisational experience with nginx. \r\n\r\nWith what you're proposing, I believe you're suggesting https traffic would ingress to the istio controller and be terminated there and then go to nginx to handle routing, and other things (like modsec).  Effectively creating a whole additional component to simply proxy some traffic to nginx.\r\n\r\nWhere I am now (simply removing the iptables rule that intercepts external traffic inbound to nginx) I do not need to add this extra moving piece and everything works fine and dandy, albeit not elegent."}}
{"actor":{"display_login":"Stono"}}