<p>I have created a Nginx Ingress and Service with the following code:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: myservice
spec:
  type: ClusterIP
  selector:
    name: my-app
  ports:
    - port: 8000
      targetPort: 8000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myingress
  annotations:
    kubernetes.io/ingress.class: nginx
  labels:
    name: myingress
spec:
  rules:
  - host: mydomain.com
    http:
      paths:
      - pathType: Prefix
        path: &quot;/&quot;
        backend:
          service:
            name: my-service
            port: 
              number: 8000

</code></pre>
<p>Nginx ingress installed with:
<code>helm install ingress-nginx ingress-nginx/ingress-nginx</code>.</p>
<p>I have also enabled proxy protocols for ELB. But in nginx logs I don't see the real client ip for X-Forwarded-For and X-Real-IP headers. This is the final headers I see in my app logs:</p>
<pre><code>X-Forwarded-For:[192.168.21.145] X-Forwarded-Port:[80] X-Forwarded-Proto:[http] X-Forwarded-Scheme:[http] X-Real-Ip:[192.168.21.145] X-Request-Id:[1bc14871ebc2bfbd9b2b6f31] X-Scheme:[http]
</code></pre>
<p>How do I get the real client ip instead of the ingress pod IP? Also is there a way to know which headers the ELB is sending to the ingress?</p>

<p>One solution is to use <code>externalTrafficPolicy</code>: <code>Local</code> (see <a href="https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip" rel="noreferrer">documentation</a>).</p>
<p>In fact, according to the <code>kubernetes documentation</code>:</p>
<blockquote>
<p>Due to the implementation of this feature, the source IP seen in the target container is not the original source IP of the client.
...
service.spec.externalTrafficPolicy - denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. There are two available options: Cluster (default) and Local. Cluster obscures the client source IP and may cause a second hop to another node, but should have good overall load-spreading. Local preserves the client source IP and avoids a second hop for LoadBalancer and NodePort type services, but risks potentially imbalanced traffic spreading.</p>
</blockquote>
<p>If you want to follow this route, update your <code>nginx ingress controller</code> <code>Service</code> and add the <code>externalTrafficPolicy</code> field:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-controller
spec:
  ...
  externalTrafficPolicy: Local
</code></pre>
<p>A possible alternative could be to use <a href="https://www.nginx.com/resources/admin-guide/proxy-protocol/" rel="noreferrer">Proxy protocol</a> (see <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-proxy-protocol" rel="noreferrer">documentation</a>)</p>
