[Bug] Kubernetes 배포 시 `LoggingMiddleware`이 실제 IP를 추적하지 못함

[Zerohertz]

What happened?

Kubernetes를 통해 배포했을 때 middleware가 요청의 IP를 출력하지 못함

Relevant log output

https://github.com/Zerohertz/fastapi-boilerplate/blob/a1e0486dc36719d86c8a9bd65212db1144532d95/app/core/middlewares.py#L14-L21

2025-01-15 21:33:57.253 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:39444] [URL: http://api.zerohertz.xyz/v1/shields/jmy] [Method: GET] [Status: Processing...]
2025-01-15 21:33:57.253 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:39444] [URL: http://api.zerohertz.xyz/v1/shields/jmy] [Method: GET] [Status: 200 (Elapsed Time: 0.000s)]
2025-01-15 21:34:09.107 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:38392] [URL: http://api.zerohertz.xyz/docs] [Method: GET] [Status: Processing...]
2025-01-15 21:34:09.107 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:38392] [URL: http://api.zerohertz.xyz/docs] [Method: GET] [Status: 200 (Elapsed Time: 0.000s)]
2025-01-15 21:34:09.258 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:38392] [URL: http://api.zerohertz.xyz/openapi.json] [Method: GET] [Status: Processing...]
2025-01-15 21:34:09.259 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:38392] [URL: http://api.zerohertz.xyz/openapi.json] [Method: GET] [Status: 200 (Elapsed Time: 0.000s)]
2025-01-15 21:34:12.098 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:38392] [URL: http://api.zerohertz.xyz/docs] [Method: GET] [Status: Processing...]
2025-01-15 21:34:12.099 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:38392] [URL: http://api.zerohertz.xyz/docs] [Method: GET] [Status: 200 (Elapsed Time: 0.000s)]
2025-01-15 21:34:12.178 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:38392] [URL: http://api.zerohertz.xyz/openapi.json] [Method: GET] [Status: Processing...]
2025-01-15 21:34:12.179 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:38392] [URL: http://api.zerohertz.xyz/openapi.json] [Method: GET] [Status: 200 (Elapsed Time: 0.000s)]
2025-01-15 21:34:20.514 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:51208] [URL: http://api.zerohertz.xyz/v1/shields/jmy] [Method: GET] [Status: Processing...]
2025-01-15 21:34:20.514 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:51208] [URL: http://api.zerohertz.xyz/v1/shields/jmy] [Method: GET] [Status: 200 (Elapsed Time: 0.000s)]
2025-01-15 21:34:20.827 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:51208] [URL: http://api.zerohertz.xyz/favicon.ico] [Method: GET] [Status: Processing...]
2025-01-15 21:34:20.828 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:51208] [URL: http://api.zerohertz.xyz/favicon.ico] [Method: GET] [Status: 404 (Elapsed Time: 0.000s)]
2025-01-15 21:35:03.219 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:34626] [URL: http://api.zerohertz.xyz/docs] [Method: GET] [Status: Processing...]
2025-01-15 21:35:03.219 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:34626] [URL: http://api.zerohertz.xyz/docs] [Method: GET] [Status: 200 (Elapsed Time: 0.000s)]
2025-01-15 21:35:03.318 KST | INFO     | app.core.middlewares:dispatch:37 - [IP: 192.168.208.121:34626] [URL: http://api.zerohertz.xyz/openapi.json] [Method: GET] [Status: Processing...]
2025-01-15 21:35:03.319 KST | INFO     | app.core.middlewares:dispatch:51 - [IP: 192.168.208.121:34626] [URL: http://api.zerohertz.xyz/openapi.json] [Method: GET] [Status: 200 (Elapsed Time: 0.000s)]

[Zerohertz]

Note

Ingress로 사용하고 있는 Traefik의 IP를 출력하고 있음

NAME                                       READY   STATUS    RESTARTS   AGE    IP                NODE               NOMINATED NODE   READINESS GATES
...
traefik-65f8464c96-wd2pr                   1/1     Running   0          164d   192.168.208.121   0hz-controlplane   <none>           <none>

[Zerohertz]

https://community.traefik.io/t/dont-understand-how-setup-forwarding-x-forwarded-for-header-via-traefik-to-services-in-k8s/9031/2

Thanks for your interest in Traefik!

By default, Traefik will override all X-Forwarded-* headers in the request if the sources sending those headers are not trusted. The following documentation explained how to configure the trusted sources: https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers

As a side note, you are not seeing the X-Forwarded-For in the logs because, as said before, this header is removed by Traefik and added later by the ReverseProxy implementation in the go standard library.

Hope this helps.

[Zerohertz]

비슷한 글들을 많이 찾았지만.. 해결은 하지 못했다...

• Traefiklabs: Don’t understand how setup forwarding “X-Forwarded-For” header via Traefik to services in K8s
• Traefiklabs: X-Forwarded-For missing
• Kun-Hung Tsai: How to Use X-Forwarded-For for IP Filtering in Traefik

$ kg po -n kube-system traefik-86499f996d-wck7z -oyaml  | grep -i insecure -A 1 -B 3
    - --metrics.prometheus.entrypoint=metrics
    - --providers.kubernetescrd
    - --providers.kubernetesingress
    - --entryPoints.web.forwardedHeaders.insecure
    - --entryPoints.web.proxyProtocol.insecure
    - --entryPoints.websecure.http.tls=true
    - --entryPoints.websecure.forwardedHeaders.insecure
    - --entryPoints.websecure.proxyProtocol.insecure
    - --log.level=INFO

[Zerohertz]

Important

https://community.traefik.io/t/getting-real-client-ip-x-forwarded-for-in-k3s-multi-server-ha-setup/16095/4
💨 대 STACKOVERFLOW 💨
만세............................................

[Zerohertz]

Traefik의 Helm chart에 service.spec.externalTrafficPolicy: Local로 설정하면 된다!!!

(Default value: service.spec.externalTrafficPolicy: Cluster)