AWS alb eks traefik realip后端真实IP

背景：

亚马逊 eks 集群代理用了traefik alb绑定 traefik 在node 上面暴露的端口，对外提供服务。一直也没有在意是否能正常获取客户端IP（腾讯云 阿里云的traefik 后端应用都能正常获取客户端IP），后端php服务基础镜像基于https://github.com/richarvey/nginx-php-fpm构建，对日志进行了json格式化，安装了一些其他依赖。最近后端小伙伴有个需求要获取到客户端IP然后上传给第三方，这才发现xff字段是内网IP，大概就是这样的：

{"@timestamp_local":"2023-06-27T10:37:10+00:00","host":"10.0.36.94","clientip":"10.0.37.83","size":552,"responsetime":0.000,"upstreamtime":"0.000","upstreamhost":"127.0.0.1:1215","http_host":"xxx.xxxx.com","url":"/","type":"newnginx-api","request":"GET / HTTP/1.1","time_local":"27/Jun/2023:10:37:10 +0000","xff":"10.0.16.130","city_name":"-","country_code2":"-","country_name":"-","latitude":"-","longitude":"-","region_name":"-","region_code":"-","referer":"-","agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36","status":"502"}

注：图文不符阿，两个环境！但是演示效果一样！
xff字段获取的是内网IP怎么破？如何获取客户端真实IP呢？

traefik alb 透传客户端真实IP

ALB的配置

点开属性面板：


我也尝试了附加？貌似不可以，保留会显示两个IP但是可以显示客户端真实IP！

traefik相关配置

traefik的部署方式基本是Kubernetes 1.20.5 安装traefik在腾讯云下的实践这样的。当然了crd rbac等用了官方新的配置文件！
traefik修改配置参照：https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
traefik-config.yaml

      web:
        address: ":80"          ## 配置 80 端口，并设置入口名称为 web
        forwardedHeaders:
          insecure: true
        proxyProtocol:
          insecure: true

注： alb https也直接挂载了后端http 端口（web端口），故只做了web相关配置，这里根据实际需求进行配置！

kubectl apply -f traefik-config.yaml -n traefik

删除Pod 使Pod重新加载configmap文件！当然了如果有更优雅的方式也可以使用，我这里就暴力一下了！

[root@ip-10-0-13-199 yaml]# kubectl get pods -n traefik
NAME                               READY   STATUS    RESTARTS   AGE
traefik-ingress-controller-229bm   1/1     Running   0          32m
traefik-ingress-controller-n9fzv   1/1     Running   0          32m
traefik-ingress-controller-vlbqs   1/1     Running   0          32m
[root@ip-10-0-13-199 yaml]# kubectl delete pods traefik-ingress-controller-229bm traefik-ingress-controller-n9fzv  traefik-ingress-controller-vlbqs  -n traefik
pod "traefik-ingress-controller-229bm" deleted
pod "traefik-ingress-controller-n9fzv" deleted
pod "traefik-ingress-controller-vlbqs" deleted

继续浏览器访问后端web项目域名：

恩xff字段可以显示客户端公网IP了！就先这样了
另外还有一个集群的traefik helm配置的该怎么搞呢？个人觉得应该是这样：https://community.traefik.io/t/forwardedheaders-insecure-to-true-not-working/11092/4
修改value.yaml中配置：

  - "--entryPoints.web.forwardedHeaders.insecure"
  - "--entryPoints.web.proxyProtocol.insecure"

然后upgrade?:

helm upgrade traefik2  -f values.yaml traefik-14.0.1.tgz -n kube-system

正式环境就先写的等维护的时候操作了！试过了没有问题：

其他：

traefik pod日志中可能会出现这样的日志：

参照：
https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-gateway/#rbac
cat gateway-rbac.yaml

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gateway-role
rules:
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - gateway.networking.k8s.io
    resources:
      - gatewayclasses
      - gateways
      - httproutes
      - tcproutes
      - tlsroutes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - gateway.networking.k8s.io
    resources:
      - gatewayclasses/status
      - gateways/status
      - httproutes/status
      - tcproutes/status
      - tlsroutes/status
    verbs:
      - update

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gateway-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gateway-role
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: traefik

kubectl apply -f gateway-rbac.yaml -n traefik

delete pods 查看日志就没有那些烦人的日志了！当然如果没有使用gateway or 没有强迫症可以忽略