haproxy源ip地址显示Kubernetes节点ip地址

Question

我在 Kubernetes 容器中运行了 HAproxy。这是示例日志的样子

<134>Jul 20 13:11:37 haproxy[6]: <SOURCE_ADDRESS> [20/Jul/2020:13:11:37.713] front gameApi/game-api-test 0/0/0/9/9 200 384 - - ---- 37/37/0/0/0 0/0 {<FORWARD_FOR_ADDRESS>} "GET /api/games/lists?dtype=brandlist HTTP/1.1"

这里的 是 haproxy kubernetes 节点的 IP 地址，我需要它是 clinet/forwardfor 的 IP 地址，以便 filebeat 能够正确解析地理位置。

编辑：

我找到了一个使用 haproxy 的解决方案，即简单地设置 http-request set-src hdr(x-forwarded-for)

但是，尝试使用解决方案 externalTrafficPolicy: Local 似乎破坏了我为网站提供服务的能力。当我尝试访问某个网站时，它会说“无法访问此网站”或“安全连接失败”

代理服务

apiVersion: v1

kind: Service
metadata: 
  name: haproxy-test
  labels:
    app: haproxy-test
  namespace: test
  annotations:
    # Note that the backend talks over HTTP.
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-sload-balancer-ssl-cert: arn:aws:acm:us-east-2:redacted:certificate/redacted
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
spec: 
  type: LoadBalancer
  externalTrafficPolicy: Local
  ports: 
  - port: 80
    name: http
    targetPort: 80
    protocol: "TCP"
  - port: 443
    name: https
    targetPort: 80
    protocol: "TCP"
  selector: 
    app: haproxy-test
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: haproxy-test
  namespace: test
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: haproxy-test
    spec:
      containers:
      - name: haproxy-test
        image: <redacted>.dkr.ecr.us-east-2.amazonaws.com/haproxy:$TAG
        imagePullPolicy: Always
        ports:
        - containerPort: 80
        resources:
          limits:
            cpu: "50m"
          requests:
            cpu: "25m"

Answer 1

您可以通过将externalTrafficPolicy 设置为local 来保留源IP。检查此问题以获取更多详细信息How do Kubernetes NodePort services with Service.spec.externalTrafficPolicy=Local route traffic?

也可以使用http-request set-src hdr(x-forwarded-for) 来配置HAProxy，以使用X-Forward-For 标头的内容来建立其内部概念，即请求的源地址，而不是启动入站连接的实际IP 地址。