<p>I would like to ask you about some assistance:</p>

<p>Entrypoint to cluster for http/https is NGINX: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.25.0 running as deamonset</p>

<p>I want to achieve 2 things:</p>

<ol>
<li>preserve source IP of client</li>
<li>direct traffic to nginx replica on
    current server (so if request is sent to server A, listed as
    externalIP address, nginx on node A should handle it)</li>
</ol>

<p>Questions:</p>

<ul>
<li>How is it possible?</li>
<li>Is it possible without nodeport? <em>Control plane can be started with custom --service-node-port-range so I can add nodeport for 80
and 443, but it looks a little bit like a hack (after reading about
nodeport intended usage)</em></li>
</ul>

<p>I was considering using <strong>metallb</strong>, but layer2 configuration will cause bottleneck (high traffic on cluster). I am not sure if BGP will solve this problem.</p>

<ul>
<li>Kubernetes <strong>v15</strong></li>
<li>Bare-metal</li>
<li>Ubuntu <strong>18.04</strong></li>
<li>Docker <strong>(18.9)</strong> and WeaveNet <strong>(2.6)</strong></li>
</ul>

Hoggie
<p>You can preserve the source IP of client by using <code>externalTrafficPolicy</code> set to <code>local</code>, this will proxy requests to local endpoints. This is explained on <a href="https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-type-nodeport" rel="nofollow noreferrer">Source IP for Services with Type=NodePort</a>.</p>

<p>Can should also have a look at <a href="https://kubernetes.io/docs/tutorials/services/source-ip/" rel="nofollow noreferrer">Using Source IP</a>.</p>

<p>In case of <a href="https://metallb.universe.tf/" rel="nofollow noreferrer">MetalLB</a>:</p>

<blockquote>
  <p>MetalLB respects the service’s  <code>externalTrafficPolicy</code>  option, and implements two different announcement modes depending on what policy you select. If you’re familiar with Google Cloud’s Kubernetes load balancers, you can probably skip this section: MetalLB’s behaviors and tradeoffs are identical.</p>
  
  <h3><a href="https://v0-2-0--metallb.netlify.com/usage/#local-traffic-policy" rel="nofollow noreferrer" title="Permanent link">“Local” traffic policy</a></h3>
  
  <p>With the  <code>Local</code>  traffic policy, nodes will only attract traffic if they are running one or more of the service’s pods locally. The BGP routers will load-balance incoming traffic only across those nodes that are currently hosting the service. On each node, the traffic is forwarded only to local pods by  <code>kube-proxy</code>, there is no “horizontal” traffic flow between nodes.</p>
  
  <p>This policy provides the most efficient flow of traffic to your service. Furthermore, because  <code>kube-proxy</code>  doesn’t need to send traffic between cluster nodes, your pods can see the real source IP address of incoming connections.</p>
  
  <p>The downside of this policy is that it treats each cluster node as one “unit” of load-balancing, regardless of how many of the service’s pods are running on that node. This may result in traffic imbalances to your pods.</p>
  
  <p>For example, if your service has 2 pods running on node A and one pod running on node B, the  <code>Local</code>  traffic policy will send 50% of the service’s traffic to each  <em>node</em>. Node A will split the traffic it receives evenly between its two pods, so the final per-pod load distribution is 25% for each of node A’s pods, and 50% for node B’s pod. In contrast, if you used the  <code>Cluster</code>  traffic policy, each pod would receive 33% of the overall traffic.</p>
  
  <p>In general, when using the  <code>Local</code>  traffic policy, it’s recommended to finely control the mapping of your pods to nodes, for example using <a href="https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity" rel="nofollow noreferrer">node anti-affinity</a>, so that an even traffic split across nodes translates to an even traffic split across pods.</p>
</blockquote>

<p>You need to take for the account the limitations of <a href="https://v0-2-0--metallb.netlify.com/usage/#limitations" rel="nofollow noreferrer">BGP routing protocol</a> for MetalLB.</p>

<p>Please also have a look at this blog post <a href="https://mauilion.dev/posts/kind-metallb/" rel="nofollow noreferrer">Using MetalLb with Kind</a>.</p>
