title: Can't get real user's IP from X-Forwarded-For
body: <p>I'm running Traefik 1.7.3 on a single node Kubernetes cluster and I'm trying to get the real user IP from the <code>X-Forwarded-For</code> header but what I get instead is <code>X-Forwarded-For: 10.244.0.1</code> which is an IP in my k8s cluster.</p>
  
  <p>Here's my Traefik deployment and service:</p>
  
  <pre><code>    ---
      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: traefik-conf
      data:
        traefik.toml: |
          # traefik.toml
          debug = true
          logLevel = "DEBUG"
          defaultEntryPoints = ["http","https"]
          [entryPoints]
            [entryPoints.http]
            address = ":80"
            compress = true
            [entryPoints.http.forwardedHeaders]
            trustedIPs = [ "0.0.0.0/0" ]
            entryPoint = "https"
            [entryPoints.https]
            address = ":443"
            compress = true
            [entryPoints.https.forwardedHeaders]
            trustedIPs = [ "0.0.0.0/0" ]
            [entryPoints.https.tls]
  
          [acme]
          email = "xxxx"
          storage = "/acme/acme.json"
          entryPoint = "https"
          onHostRule = true
          #caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
          acmeLogging = true
          [[acme.domains]]
          main = "xxxx"
          [acme.dnsChallenge]
          provider = "route53"
          delayBeforeCheck = 0
  
          [persistence]
          enabled = true
          existingClaim = "pvc0"
          annotations = {}
          accessMode = "ReadWriteOnce"
          size = "1Gi"
  
          [kubernetes]
          namespaces = ["default"]
          [accessLog]
          filePath = "/acme/access.log"
          [accessLog.fields]
          defaultMode = "keep"
      ---
      kind: Deployment
      apiVersion: extensions/v1beta1
      metadata:
        name: traefik-ingress-controller
        namespace: default
        labels:
          k8s-app: traefik-ingress-lb
      spec:
        replicas: 1
        selector:
          matchLabels:
            k8s-app: traefik-ingress-lb
        template:
          metadata:
            labels:
              k8s-app: traefik-ingress-lb
              name: traefik-ingress-lb
          spec:
            serviceAccountName: traefik-ingress-controller
            terminationGracePeriodSeconds: 60
            containers:
            - image: traefik
              name: traefik-ingress-lb
              env:
                - name: AWS_ACCESS_KEY_ID
                  value: xxxx
                - name: AWS_SECRET_ACCESS_KEY
                  value: xxxx
                - name: AWS_REGION
                  value: us-west-2
                - name: AWS_HOSTED_ZONE_ID
                  value: xxxx
              ports:
              - name: http
                containerPort: 80
              - name: admin
                containerPort: 8080
              args:
              - --api
              - --kubernetes
              - --configfile=/config/traefik.toml
              volumeMounts:
              - mountPath: /config
                name: config
              - mountPath: /acme
                name: acme
            volumes:
            - name: config
              configMap:
                name: traefik-conf
            - name: acme
              persistentVolumeClaim:
                claimName: "pvc0"
      ---
      kind: Service
      apiVersion: v1
      metadata:
        name: traefik-ingress-service
        namespace: default
      spec:
        externalIPs:
        - x.x.x.x
        externalTrafficPolicy: Local
        selector:
          k8s-app: traefik-ingress-lb
        ports:
          - protocol: TCP
            port: 80
            name: web
          - protocol: TCP
            port: 443
            name: https
          - protocol: TCP
            port: 8080
            name: admin
        type: NodePort
  </code></pre>
  
  <p>And here's my ingress:</p>
  
  <pre><code>    apiVersion: extensions/v1beta1
      kind: Ingress
      metadata:
        name: headers-test
        namespace: default
        annotations:
          ingress.kubernetes.io/proxy-body-size: 500m
          kubernetes.io/ingress.class: traefik
      spec:
        rules:
        - host: xxxx
          http:
            paths:
            - path: /
              backend:
                serviceName: headers-test
                servicePort: 8080
  </code></pre>
  
  <p>I'd read that I only needed to add <code>[entryPoints.http.forwardedHeaders]</code> and a list of <code>trustedIPs</code> but that doesn't seem to work.  Am I missing something?</p>