<p>I am having issues getting the visitors real IP in my PHP app. I have Kubernetes running in Google Container Engine (master: 1.4.8, node: 1.4.7). </p>

<p>Service definition:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
    name: app-service
spec:
    type: LoadBalancer # spawning google loadbalancer
    selector:
        name: app # running simple php/nginx container
    ports:
        - port: 80
          targetPort: 80
</code></pre>

<p>How can it be that the <code>X-Forwarded-For</code> headers etc. don't get passed through to my php app? I am only getting back the source ip (in php <code>REMOTE_ADDR</code>), which is <code>10.0.1.1</code>. In Google Cloud I can see the service is using a <strong>layer 4</strong> load balancer. Could this be the issue that the real source ip is lost and the <code>X-Forwarded-For</code> header never gets set?</p>

<p>If someone could explain me what is going on, that would be super helpful!</p>

<p>For what its worth, I am using the following nginx configuration in my app container:</p>

<pre><code>location ~ \.php$ {
    fastcgi_pass php-upstream;
    fastcgi_split_path_info ^(.+\.php)(/.*)$;
    include fastcgi_params;
    fastcgi_param  SCRIPT_FILENAME  $realpath_root$fastcgi_script_name;
    fastcgi_param DOCUMENT_ROOT $realpath_root;
}
</code></pre>

<p><strong>EDIT</strong>
I have put my whole application behind CloudFlare, so it is now pointing from CloudFlare http proxy -> GCE Load Balancer. And somehow the <code>X-Forwarded-For</code> headers and all are present! For me it seems like the issue is with the GCE Load Balancer, it is somehow unable to set those headers?</p>

<p>A new feature was <a href="https://kubernetes.io/docs/user-guide/load-balancer/#loss-of-client-source-ip-for-external-traffic" rel="nofollow noreferrer">added to Kubernetes 1.5</a>:</p>

<blockquote>
  <p>Due to the implementation of this feature, the source IP for sessions as seen in the target container will not be the original source IP of the client. This is the default behavior as of Kubernetes v1.5. However, starting in v1.5, an optional beta feature has been added that will preserve the client Source IP for GCE/GKE environments. This feature will be phased in for other cloud providers in subsequent releases.</p>
</blockquote>

<p>More details are <a href="https://kubernetes.io/docs/tutorials/services/source-ip/" rel="nofollow noreferrer">available here</a> and boil down to adding an annotation for services of type <code>loadbalancer</code>:</p>

<pre><code>$ kubectl annotate service loadbalancer service.beta.kubernetes.io/external-traffic=OnlyLocal
</code></pre>

<p>This will open a healthcheck port on the node, to verify if service endpoints are available on the node.</p>

<p>More details on how this issue is rolled out to other clusters seems to be available on <a href="https://github.com/kubernetes/features/issues/27#issuecomment-269518563" rel="nofollow noreferrer">kubernetes/features</a> issue tracking this feature.</p>

<p>Note: Question seems similar to <a href="https://stackoverflow.com/questions/36988369/kubernetes-not-preserve-source-ip">StackOverflow/Kubernetes-not-preserving-source-ip</a></p>
