<p>How can I get <strong>real client IP</strong> from Nginx ingress load balancer in GKE? According to the online resource, I have configured the External Traffic Policy:  Local and added use-proxy-protocol: &quot;true&quot; property also.</p>
<p>But still, I'm seen the GKE node IP/interface in the log, not the real client IP.</p>
<p>My load balancer service -&gt;</p>
<pre><code>Name:                     ingress-nginx-controller
Namespace:                ingress-nginx
Labels:                   app.kubernetes.io/component=controller
                          app.kubernetes.io/instance=ingress-nginx
                          app.kubernetes.io/managed-by=Helm
                          app.kubernetes.io/name=ingress-nginx
                          app.kubernetes.io/version=0.41.2
                          helm.sh/chart=ingress-nginx-3.10.1
Annotations:              networking.gke.io/load-balancer-type: Internal
Selector:                 app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx
Type:                     LoadBalancer
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       xx.xxx.xx.xx
IPs:                      xx.xx.xxx.xx
LoadBalancer Ingress:     xx.xx.xx.xx
Port:                     http  80/TCP
TargetPort:               http/TCP
NodePort:                 http  32118/TCP
Endpoints:                xx.x.xx.xx:80
Port:                     https  443/TCP
TargetPort:               https/TCP
NodePort:                 https  31731/TCP
Endpoints:                xx.x.xx.xxx:443
Session Affinity:         None
External Traffic Policy:  Local
HealthCheck NodePort:     30515
</code></pre>
<p>My config map -&gt;</p>
<pre><code>apiVersion: v1
data:
  access-log-path: /var/log/nginx-logs/access.log
  compute-full-forwarded-for: &quot;true&quot;
  enable-real-ip: &quot;true&quot;
  enable-underscores-in-headers: &quot;true&quot;
  error-log-path: /var/log/nginx-logs/error.log
  large-client-header-buffers: 4 64k
  log-format-upstream: $remote_addr - $request_id - [$proxy_add_x_forwarded_for] -
    $remote_user [$time_local] &quot;$request&quot; $status $body_bytes_sent &quot;$http_referer&quot;
    &quot;$http_user_agent&quot; $request_length $request_time [$proxy_upstream_name] $upstream_addr
    $upstream_response_length $upstream_response_time $upstream_status
  proxy-read-timeout: &quot;240&quot;
  proxy-send-timeout: &quot;240&quot;
  real-ip-header: proxy_protocol
  use-forwarded-headers: &quot;true&quot;
  use-proxy-protocol: &quot;true&quot;
</code></pre>

Sidath Weerasinghe
<p>I tried to use the following <a href="/questions/tagged/nginx" class="post-tag" title="show questions tagged &#39;nginx&#39;" aria-label="show questions tagged &#39;nginx&#39;" rel="tag" aria-labelledby="tag-nginx-tooltip-container">nginx</a> ConfigMap:</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.5.1
  name: ingress-nginx-controller
  namespace: ingress-nginx
data:
  allow-snippet-annotations: &quot;true&quot;
  enable-real-ip: &quot;true&quot;
  use-forwarded-headers: &quot;true&quot;
  proxy-real-ip-cidr: &quot;&lt;pods_cidr&gt;,&lt;services_cidr&gt;,&lt;load_balance_ip&gt;/32&quot;
  use-proxy-protocol: &quot;false&quot;
</code></pre>
<p>And added the statement <code>externalTrafficPolicy: Local</code> on <a href="/questions/tagged/nginx" class="post-tag" title="show questions tagged &#39;nginx&#39;" aria-label="show questions tagged &#39;nginx&#39;" rel="tag" aria-labelledby="tag-nginx-tooltip-container">nginx</a> Service that assign the load balance:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.5.1
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  externalTrafficPolicy: Local
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - appProtocol: https
      name: https
      port: 443
      protocol: TCP
      targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: LoadBalancer
  loadBalancerIP: &lt;load_balance_ip&gt;
</code></pre>
<p>I hadn't success. Then, I also tried to configure <em>ip-masq-agent</em> with the follow ConfigMap:</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: ip-masq-agent
  namespace: kube-system
data:
  config: |
    nonMasqueradeCIDRs:
      - &lt;load_balance_ip&gt;/32
      - &lt;pods_cidr&gt;
      - &lt;services_cidr&gt;
    masqLinkLocal: false
    resyncInterval: 30s
</code></pre>
<p>So, I deleted the DaemonSet <em>ip-masq-agent</em> and <a href="/questions/tagged/gke" class="post-tag" title="show questions tagged &#39;gke&#39;" aria-label="show questions tagged &#39;gke&#39;" rel="tag" aria-labelledby="tag-gke-tooltip-container">gke</a> automatic recreated it.</p>
<p>After that, I got my <a href="/questions/tagged/gke" class="post-tag" title="show questions tagged &#39;gke&#39;" aria-label="show questions tagged &#39;gke&#39;" rel="tag" aria-labelledby="tag-gke-tooltip-container">gke</a> cluster working as expected.</p>
<p>You can find more information about <em>ip-masq-agent</em> on <a href="/questions/tagged/gke" class="post-tag" title="show questions tagged &#39;gke&#39;" aria-label="show questions tagged &#39;gke&#39;" rel="tag" aria-labelledby="tag-gke-tooltip-container">gke</a> accessing <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent</a></p>
