Managing External Traffic Policies and Source IP Preservation

Implement traffic policy settings to ensure your backend applications receive the original client IP address instead of the node's internal IP.

In this lesson, you will learn how to configure Kubernetes Service traffic policies to ensure your backend applications receive the actual client IP address instead of the internal node IP.

When you expose a service using a LoadBalancer or NodePort, Kubernetes typically performs Source Network Address Translation (SNAT). This means that by the time a request hits your Pod, the "source" IP address appears to be the node's internal IP rather than the user's actual device IP. This is often problematic for logging, security audits, or geo-blocking features that rely on the original client's location.

To solve this, Kubernetes provides the externalTrafficPolicy field within the Service specification. By setting this field to Local, you instruct the cluster to preserve the client source IP by routing traffic only to endpoints residing on the same node that received the request.

Consider this Service definition:

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app: web-app
  ports:
    - port: 80
      targetPort: 8080

The Trade-off

By setting externalTrafficPolicy: Local, you eliminate the extra "hop" required to forward traffic between nodes, which successfully preserves the original client IP. However, there is a trade-off: if a node has no ready Pods for your service, traffic sent to that specific node will be dropped rather than load-balanced across the rest of the cluster. This requires your cloud provider's Load Balancer to be health-check aware so it can route traffic away from nodes that lack healthy backend Pods.

If you use the default policy (Cluster), you gain better load balancing across all nodes, but you must rely on headers like X-Forwarded-For if your ingress controller or proxy is configured to inject them, as the raw source IP will be masked by the node's NAT.

Key Takeaway: Setting externalTrafficPolicy: Local on a Service prevents source IP masking, allowing your application to see the true client IP at the cost of requiring node-aware health checks.