<p>I have AKS with nginx load balancer (ingress controller) installed with helm as the entry point to my cluster.</p>
<p>I want to preserve the real IP addresses from clients for further whitelisting with <code>nginx.ingress.kubernetes.io/whitelist-source-range</code> on certain paths of specific services.</p>
<p>I found the solution here:</p>
<p><a href="https://stackoverflow.com/questions/60968806/nginx-ingress-controller-forward-source-ip">nginx ingress controller forward source ip</a></p>
<p>which works, but also I found in certain blogs and in the Kubernetes documentation, that setting externalTrafficPolicy=Local is not good for proper load balancing.</p>
<p>I tried to set different variations of settings to my nginx configmap, but with no luck.
I also found, that it can be done somehow with X-Forwarded-For header, but I couldn't resolve it.</p>

<p>I also made a github issue with the same question here:
<a href="https://github.com/kubernetes/ingress-nginx/issues/9402" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/issues/9402</a></p>
<p>And the discussion on the kuberenetes stack took me to the following link: <a href="https://www.asykim.com/blog/deep-dive-into-kubernetes-external-traffic-policies" rel="nofollow noreferrer">https://www.asykim.com/blog/deep-dive-into-kubernetes-external-traffic-policies</a></p>
<p>where he says that: &quot;if you have a service receiving external traffic from an LB (using NodePorts), you almost always want to use externalTrafficPolicy: Local (with pod anti-affinity to alleviate imbalanced traffic).&quot;</p>
<p>I didn't find the way how to preserve client IP without external LB or Proxy so this looks like the only possible solution. If you find any better, please comment.</p>
<p>For more info see the discussion on kubernetes stack: <a href="https://kubernetes.slack.com/archives/CANQGM8BA/p1670925074384859" rel="nofollow noreferrer">https://kubernetes.slack.com/archives/CANQGM8BA/p1670925074384859</a></p>
