<p>I created a kubernetes service in GKE with type:LoadBalancer. </p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  type: LoadBalancer
  ports:
  - name: http
    port: 80
    targetPort: http
  selector:
    app: nginx
</code></pre>

<p>It's a nginx service and try to get origin client IP. like</p>

<pre><code>        location / {
            echo $remote_addr;
            echo $http_x_forwarded_for;   
        }
</code></pre>

<p>But the result will get:</p>

<pre><code>10.140.0.97

</code></pre>

<p><code>$remote_addr</code> is like inside kubernetes IP.</p>

<p><code>$http_x_forwarded_for</code> is empty.</p>

<p>I don't know why this is not like document said.</p>

<h2>What I read</h2>

<p><a href="https://cloud.google.com/load-balancing/docs/network" rel="noreferrer">https://cloud.google.com/load-balancing/docs/network</a></p>

<blockquote>
  <p>Network Load Balancing is a pass-through load balancer, which means that your firewall rules must allow traffic from the client source IP addresses. </p>
</blockquote>

<p><a href="https://cloud.google.com/kubernetes-engine/docs/concepts/network-overview#ext-lb" rel="noreferrer">https://cloud.google.com/kubernetes-engine/docs/concepts/network-overview#ext-lb</a></p>

<blockquote>
  <p>If your Service needs to be reachable from outside the cluster and outside your VPC network, you can configure your Service as a LoadBalancer, by setting the Service's type field to LoadBalancer when defining the Service. GKE then provisions a Network Load Balancer in front of the Service. The Network Load Balancer is aware of all nodes in your cluster and configures your VPC network's firewall rules to allow connections to the Service from outside the VPC network, using the Service's external IP address. You can assign a static external IP address to the Service. Visit Configuring Domain Names with Static IP Addresses for more information.</p>
</blockquote>

<p>Just add <code>externalTrafficPolicy: Local</code></p>

<pre class="lang-yaml prettyprint-override"><code>spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
</code></pre>

<blockquote>
  <p>Packets sent to Services with Type=LoadBalancer are source NAT’d by default, because all schedulable Kubernetes nodes in the Ready state are eligible for load-balanced traffic. So if packets arrive at a node without an endpoint, the system proxies it to a node with an endpoint, replacing the source IP on the packet with the IP of the node (as described in the previous section).</p>
</blockquote>

<h2>Reference</h2>

<ul>
<li><a href="https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer" rel="noreferrer">https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer</a></li>
<li><a href="https://github.com/kubernetes/kubernetes/issues/10921" rel="noreferrer">https://github.com/kubernetes/kubernetes/issues/10921</a></li>
</ul>
