解决GKE中Nginx Ingress无法获取真实客户端IP的问题

问题说明 #

在Google Kubernetes Engine（GKE）的Nginx Ingress负载均衡器中，我已按照线上资料配置External Traffic Policy为Local，并添加use-proxy-protocol: "true"属性，但日志里仍显示GKE节点IP/接口，而非真实客户端IP。

负载均衡器服务配置 #

Name:                     ingress-nginx-controller
Namespace:                ingress-nginx
Labels:                   app.kubernetes.io/component=controller
                          app.kubernetes.io/instance=ingress-nginx
                          app.kubernetes.io/managed-by=Helm
                          app.kubernetes.io/name=ingress-nginx
                          app.kubernetes.io/version=0.41.2
                          helm.sh/chart=ingress-nginx-3.10.1
Annotations:              networking.gke.io/load-balancer-type: Internal
Selector:                 app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx
Type:                     LoadBalancer
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       xx.xxx.xx.xx
IPs:                      xx.xx.xxx.xx
LoadBalancer Ingress:     xx.xx.xx.xx
Port:                     http  80/TCP
TargetPort:               http/TCP
NodePort:                 http  32118/TCP
Endpoints:                xx.x.xx.xx:80
Port:                     https  443/TCP
TargetPort:               https/TCP
NodePort:                 https  31731/TCP
Endpoints:                xx.x.xx.xxx:443
Session Affinity:         None
External Traffic Policy:  Local
HealthCheck NodePort:     30515

ConfigMap配置 #

apiVersion: v1
data:
  access-log-path: /var/log/nginx-logs/access.log
  compute-full-forwarded-for: "true"
  enable-real-ip: "true"
  enable-underscores-in-headers: "true"
  error-log-path: /var/log/nginx-logs/error.log
  large-client-header-buffers: 4 64k
  log-format-upstream: $remote_addr - $request_id - [$proxy_add_x_forwarded_for] -
    $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer"
    "$http_user_agent" $request_length $request_time [$proxy_upstream_name] $upstream_addr
    $upstream_response_length $upstream_response_time $upstream_status
  proxy-read-timeout: "240"
  proxy-send-timeout: "240"
  real-ip-header: proxy_protocol
  use-forwarded-headers: "true"
  use-proxy-protocol: "true"

解决方案 #

1. 为内部LB配置Proxy Protocol启用规则 #

GKE内部负载均衡器默认不会开启Proxy Protocol，需要通过BackendConfig资源配合服务注解来启用：

• 创建BackendConfig资源：

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: proxy-protocol-config
  namespace: ingress-nginx
spec:
  proxyProtocol:
    enabled: true

• 更新Ingress Controller服务的注解，关联上述BackendConfig：

annotations:
  networking.gke.io/load-balancer-type: Internal
  cloud.google.com/backend-config: '{"default": "proxy-protocol-config"}'

2. 调整日志格式验证真实IP #

当前日志格式使用$remote_addr，在Proxy Protocol生效后，该字段应显示真实客户端IP；若仍有问题，可尝试将日志格式中的$remote_addr替换为$proxy_protocol_addr，直接获取Proxy Protocol传递的源IP。

3. 确认配置生效并重启Pod #

修改配置后，重启Ingress Controller Pod确保配置加载：

kubectl rollout restart deployment ingress-nginx-controller -n ingress-nginx

内容的提问来源于stack exchange，提问作者Sidath Weerasinghe