<p>We use Google Cloud Run on our K8s cluster on GCP which is powered by Knative and Anthos, however it seems the load balancer doesn't amend the x-forwarded-for (and this is not expected as it is TCP load balancer), and Istio doesn't do the same.</p>
<p>Do you have the same issue or it is limited to our deployment?
I understand Istio support this as part of their upcoming <a href="https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies/" rel="nofollow noreferrer">Gateway Network Topology</a> but not in the current gcp version.</p>

KimDai
<p>I think you are correct in assessing that current Cloud Run for Anthos set up (unintentionally) does not let you see the origin IP address of the user.</p>
<p>As you said, the created gateway for Istio/Knative in this case is a Cloud Network Load Balancer (TCP) and this LB doesn’t preserve the client’s IP address on a connection when the traffic is routed to Kubernetes Pods (due to how Kubernetes networking works with iptables etc). That’s why you see an <code>x-forwarded-for</code> header, but it contains internal hops (e.g. 10.x.x.x).</p>
<p>I am following up with our team on this. It seems that it was not noticed before.</p>
