kubernetes 如何从GKE中的Nginx入口负载平衡器获取真实的客户端IP

4ngedf3f 于 2022-11-02 发布在 Kubernetes

关注(0)|答案(1)|浏览(117)

如何从GKE中的Nginx入口负载均衡器获取真实的客户端IP？根据在线资源，我已经配置了外部流量策略：本地和添加的use-proxy-protocol：“真”属性也。
但是，我仍然在日志中看到了GKE节点IP/接口，而不是真实的的客户端IP。
我的负载平衡器服务-〉

Name:                     ingress-nginx-controller
Namespace:                ingress-nginx
Labels:                   app.kubernetes.io/component=controller
                          app.kubernetes.io/instance=ingress-nginx
                          app.kubernetes.io/managed-by=Helm
                          app.kubernetes.io/name=ingress-nginx
                          app.kubernetes.io/version=0.41.2
                          helm.sh/chart=ingress-nginx-3.10.1
Annotations:              networking.gke.io/load-balancer-type: Internal
Selector:                 app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx
Type:                     LoadBalancer
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       xx.xxx.xx.xx
IPs:                      xx.xx.xxx.xx
LoadBalancer Ingress:     xx.xx.xx.xx
Port:                     http  80/TCP
TargetPort:               http/TCP
NodePort:                 http  32118/TCP
Endpoints:                xx.x.xx.xx:80
Port:                     https  443/TCP
TargetPort:               https/TCP
NodePort:                 https  31731/TCP
Endpoints:                xx.x.xx.xxx:443
Session Affinity:         None
External Traffic Policy:  Local
HealthCheck NodePort:     30515

我的配置图-〉

apiVersion: v1
data:
  access-log-path: /var/log/nginx-logs/access.log
  compute-full-forwarded-for: "true"
  enable-real-ip: "true"
  enable-underscores-in-headers: "true"
  error-log-path: /var/log/nginx-logs/error.log
  large-client-header-buffers: 4 64k
  log-format-upstream: $remote_addr - $request_id - [$proxy_add_x_forwarded_for] -
    $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer"
    "$http_user_agent" $request_length $request_time [$proxy_upstream_name] $upstream_addr
    $upstream_response_length $upstream_response_time $upstream_status
  proxy-read-timeout: "240"
  proxy-send-timeout: "240"
  real-ip-header: proxy_protocol
  use-forwarded-headers: "true"
  use-proxy-protocol: "true"

kubernetes

来源：https://stackoverflow.com/questions/73587157/how-can-i-get-real-client-ip-from-nginx-ingress-load-balancer-in-gke

1条答案

按热度按时间

h5qlskok1#

你好吗？
您还需要在Kubernetes规范中设置此参数：

externalTrafficPolicy: Local

例如，

apiVersion: v1
kind: Service
metadata:
  name: example-service
spec:
  selector:
    app: example
  ports:
    - port: 8765
      targetPort: 9376
  externalTrafficPolicy: Local
  type: LoadBalancer

因此，您可以在Nginx设置中使用这些设置：

use-proxy-protocol: "false"
enable-real-ip: "true"
use-forwarded-headers: "true"
proxy-real-ip-cidr: "YOUR-LB-IP/32"

加上

如果你想强制HTTPS重定向，那么你可以根据需要在Nginx设置中进行设置：

force-ssl-redirect: "true"

请访问www.example.com了解更多https://cloud.google.com/kubernetes-engine/docs/how-to/service-parameters#externalTrafficPolicy

赞(0）回复(0）举报 2022-11-02

我来回答

kubernetes 如何从GKE中的Nginx入口负载平衡器获取真实的客户端IP

1条答案

相关问题

热门标签

最新问答