How to get real ip addresses?

[Ognian]

I have a 2 node configuration: one raspberry pi 4 as worker and one amd64 node as master.
I have configured traefik the following way:

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    additionalArguments:
      - "--entrypoints.web.proxyProtocol.insecure"
      - "--entrypoints.web.forwardedHeaders.insecure"
      - "--entrypoints.websecure.proxyProtocol.insecure"
      - "--entrypoints.websecure.forwardedHeaders.insecure"
    service:
      spec:
        externalTrafficPolicy: Local # default is Cluster see https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

and keycloak is also configured to trust the X-Forwarded-For header (by setting proxy: edge), but I still see all requests from 10.42.0.2...

Is there something else to configure, especially infront of traefik? p2p?

Thanks
Ognian

[Ognian]

Some more info:
I've enabled traefik full access log logging via:

   additionalArguments:
      - "--accesslog"
      - "--accesslog.format=json"
      - "--accesslog.fields.defaultmode=keep"
      - "--accesslog.fields.headers.defaultmode=keep"

and looking at the X-Forwarded headers they are wrong:

"request_X-Forwarded-Host":"lp3dnode.level1.ogi-it.com","request_X-Forwarded-Port":"443","request_X-Forwarded-Proto":"https","request_X-Forwarded-Server":"traefik-65c6cc66bf-q8pvw","request_X-Real-Ip":"10.42.0.2"

so the problem seams in front of traefik...

[Ognian]

So in front of traefik there is the klipper LB, and this is the corresponding issue regarding real ip addresses: k3s-io/klipper-lb#31.
I've tried the solutions mentioned inside, even with a single node, I did not succeed. With older versions of k3os and these instructions I was able to get the real ip address, but not with kairos...

@mudler do you know of a better configuration or more suitable LoadBalancer to solve this problem?