<p>My setup is a bare metal cluster running Kubernetes 1.17. I'm using Traefik 2(.3.2) as a reverse proxy and to get failover for my machines I use <code>kube-keepalive-vip</code> [1].</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-keepalived-vip-config
  namespace: kube-system
data:
  172.111.222.33: kube-system/traefik2-ingress-controller
</code></pre>
<p>Therefore my traefik service is of default type cluster IP and references an external IP provided by the <code>kube-keepalive-vip</code> service:</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: v1
kind: Service
metadata:
  name: traefik2-ingress-controller
  namespace: kube-system
spec:
  selector:
    app: traefik2-ingress-controller
  ports:
    - protocol: TCP
      name: web
      port: 80
    - protocol: TCP
      name: webs
      port: 443
  externalIPs:
    - 172.111.222.33
</code></pre>
<p>This works as it is. Now I want to restrict some of my applications to be accessible only from a specific subnet inside my network. Since my requests are handled by <code>kube-keepalive-vip</code> and also <code>kube-proxy</code>, the client IP in my requests is not the one of the actual client anymore. But as far as I got the documentation <code>kube-proxy</code> is setting the real ip in the <code>X-Forwarded-For</code> header. So my Middleware looks like this:</p>
<pre class="lang-yaml prettyprint-override"><code>internal-ip-whitelist:
  ipWhiteList:
    sourceRange:
      - 10.0.0.0/8 # my subnet
      - 60.120.180.240 # my public ip
    ipStrategy:
      depth: 2 # take second entry from X-Forwarded-For header
</code></pre>
<p>Now each request to  the ingresses this middleware is attached to is rejected. I checked the Traefik logs and saw, that the requests contain some <code>X-Forwarded-*</code> headers, but there is no <code>X-Forwarded-For</code> :(</p>
<p>Has anyone any experience with this and can point me to my error? Is there probably something wrong with my Kubernetes setup? Or is there something missing in my <code>kube-keepalive-vip</code> config?</p>
<p>Thanks in advance!</p>
<p>[1] <a href="https://github.com/aledbf/kube-keepalived-vip" rel="nofollow noreferrer">https://github.com/aledbf/kube-keepalived-vip</a></p>

<p>For everyone stumbling upon this, I managed to fix my problem in the meantime.</p>
<p>The main problem is <code>kube-proxy</code>. By default all services are routed through it. And, depending on your CNI provider (I use <code>flannel</code>), the information of your calling client is lost there.</p>
<p>K8s provides a way around that by setting the <code>.spec.externalTrafficPolicy</code> to <code>Local</code> (<a href="https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support</a>). But this is not supported for <code>ClusterIP</code> services.</p>
<p>So I got around that by using MetalLB (<a href="https://metallb.universe.tf/" rel="nofollow noreferrer">https://metallb.universe.tf/</a>) which provides load balancing for <em>bare metal</em> clusters. After setting it up with my virtual IP that was assigned to the keepalived container before, I configured the traefik service with type <code>LoadBalancer</code> and requested the one IP I have in MetalLB.</p>
