TronAr
Expert
Expert

Source IP visible from container in vSphere with kubernetes ?

Jump to solution

Hi,

playing with a demo I see that service type LoadBalancer does SNAT, so the original source IP is not visible at the app code.

Is there any way to disable that ? (i.e. to have source IP visibility)

This is in a native cluster, BTW.

TIA,

-Carlos

1 Solution

Accepted Solutions
daphnissov
Immortal
Immortal

Either way you would have to use an Ingress resource to get a L7 load balancer. Service of type LoadBalancer provisions a L4 one. In NSX-T, you would have to manually assign an application profile that passes the X-Forwarded-For header where that information is preserved. This would be supported in something like TKGI but it's not out of the box in vSphere with Tanzu Standard. With HAProxy, you would again have to manually edit the config file and something like option forwardfor.

View solution in original post

5 Replies
daphnissov
Immortal
Immortal

Are you asking about Basic with HAProxy or Standard with NSX-T?

0 Kudos
TronAr
Expert
Expert

Should I choose ? Smiley Happy

For the time being, NSX-T based. But would not mind knowing if HA-Proxy makes a difference...

0 Kudos
daphnissov
Immortal
Immortal

No, I'm not asking you to choose, I'm asking what you are actually using because it makes a difference. Do you have vSphere with Tanzu Standard (part of VCF with NSX-T) or Basic (standalone vSphere with HAProxy)?

0 Kudos
TronAr
Expert
Expert

I know, I understand what you are asking.

But I'm in search for knowledge, not for a solution, so I would not mind knowing how it works in both cases.

The issue at hand, where I found that IP was not being preserved, is using NSX-T a.k.a. vSphere with kubernetes.

0 Kudos
daphnissov
Immortal
Immortal

Either way you would have to use an Ingress resource to get a L7 load balancer. Service of type LoadBalancer provisions a L4 one. In NSX-T, you would have to manually assign an application profile that passes the X-Forwarded-For header where that information is preserved. This would be supported in something like TKGI but it's not out of the box in vSphere with Tanzu Standard. With HAProxy, you would again have to manually edit the config file and something like option forwardfor.

View solution in original post