Background

There may be different types of proxy servers between a client and a container server. How can a container obtain the real source IP address of the client? This section describes several scenarios you may encounter.

Principles

Layer-7 forwarding:

Ingress: If this access mode is used, the client source IP address is saved in the X-Forwarded-For HTTP header field by default. No other configuration is required.

• ELB ingress: A self-developed ingress to implement layer-7 network access between the internet and intranet (in the same VPC) based on ELB. If the backend Service type is NodePort, set Service Affinity to Node level.
• Nginx ingress: An ingress that implements layer-7 networking based on the nginx-ingress add-on. The backend Service type can be either ClusterIP or NodePort. If the backend Service type is NodePort, set Service Affinity to Node level.

Layer-4 forwarding:

• LoadBalancer: Use HUAWEI CLOUD ELB to achieve load balancing. You can manually enable the Obtain Client IP Address option for TCP and UDP listeners of shared load balancers. By default, the Obtain Client IP Address option is enabled for TCP and UDP listeners of dedicated load balancers. You do not need to manually enable it.
• NodePort: In this access mode, the container port is mapped to the node port. If cluster-level affinity is configured, access requests will be forwarded through the node and the client source IP address cannot be obtained. If node-level affinity is configured, access requests are not forwarded and the client source IP address can be obtained.

If Istio is used, you can obtain the source IP address by referring to How Do I Obtain the IP Address of a Client If I Use Istio for My Services.

Scenarios in Which Source IP Address Can Be Obtained

Due to network model differences, CCE does not support obtaining source IP addresses in some scenarios, as listed in Table 1. "-" in the table indicates that this scenario does not exist.

Ingress

Configure the application server and obtain the IP address of a client from the HTTP header.

The real IP address is placed in the X-Forwarded-For HTTP header field by the load balancer in the following format:

X-Forwarded-For: IP address of the client,Proxy server 1-IP address,Proxy server 2-IP address,...

If you use this method, the first IP address obtained is the IP address of the client.

For details, see How Can I Obtain the IP Address of a Client.

• In the Cloud Native Network 2.0 model, source IP addresses cannot be obtained if a shared load balancer is used when an ingress is interconnected with the nginx-ingress add-on. For details, see Scenarios in Which Source IP Address Can Be Obtained. To obtain the source IP addresses, uninstall the nginx-ingress add-on and use the dedicated load balancer during reinstallation. For details, see Installing the nginx-ingress Add-on.
• When adding an ingress, if the backend service is of the NodePort type, set Service Affinity to Node level, that is, set spec.externalTrafficPolicy to Local. For details, see NodePort.

LoadBalancer

VPC and Container Tunnel Network Models

To obtain source IP addresses, perform the following steps:

1. When creating a LoadBalancer Service on the CCE console, set Service Affinity to Node level instead of Cluster level.

   

2. Go to the ELB console and enable the function of obtaining the client IP address of the listener corresponding to the load balancer. Transparent transmission of source IP addresses is enabled for dedicated load balancers by default. You do not need to manually enable this function.
   1. Log in to the ELB console.
   2. Click in the upper left corner to select the desired region and project.
   3. Click Service List. Under Network, click Elastic Load Balance.
   4. On the Load Balancers page, click the name of the load balancer.
   5. Click Listeners.
   6. To add a listener, click Add Listener.
   7. To modify a listener, locate the listener and click on the right of its name.
   8. Enable Obtain Client IP Address.
      Figure 1 Enabling the function
      

Cloud Native Network 2.0 Model

In the Cloud Native Network 2.0 model, when a shared load balancer is used for load balancing, the service affinity cannot be set to Node level. As a result, source IP addresses cannot be obtained. To obtain a source IP address, you must use an ENI LoadBalancer Service to connect to the dedicated load balancer. External access to the container does not need to pass through the forwarding plane.

By default, transparent transmission of source IP addresses is enabled for dedicated load balancers. You do not need to manually enable Obtain Client IP Address on the ELB console. Instead, you only need to select a dedicated load balancer when creating an ENI LoadBalancer Service on the CCE console, as shown in the following figure.

NodePort

Set the service affinity of a NodePort Service to Node level instead of Cluster level. That is, set spec.externalTrafficPolicy of the Service to Local.

In the Cloud Native Network 2.0 model, the service affinity of the NodePort Service cannot be set to Node level. Therefore, source IP addresses cannot be obtained in this model.

Figure 2 Selecting a node-level affinity