feat: add Traefik configuration to preserve client IP and update LoadBalancer service settings

README.md

@@ -126,11 +126,22 @@ kubectl apply -f k3s/expose-ingress.yaml
 curl -si "http://<node-ip>/"
 ```
 
+By default the app sees a cluster-internal address (for example `10.42.0.1`)
+instead of the real client IP, because the Traefik Service runs with
+`externalTrafficPolicy: Cluster`. To preserve the client IP, apply
+[k3s/traefik-config.yaml](k3s/traefik-config.yaml), which sets
+`externalTrafficPolicy: Local` on the Traefik Service:
+
+```bash
+kubectl apply -f k3s/traefik-config.yaml
+```
+
 #### Option 2: ServiceLB
 
 k3s also includes the ServiceLB load balancer. The single `LoadBalancer`
 Service in [k3s/expose-servicelb.yaml](k3s/expose-servicelb.yaml) exposes the
-app on port 8080 of the node's IP address, without an Ingress:
+app on port 8080 of the node's IP address, without an Ingress. The Service sets
+`externalTrafficPolicy: Local` so the app sees the real client IP:
 
 ```bash
 kubectl apply -f k3s/expose-servicelb.yaml

k3s/expose-servicelb.yaml

@@ -4,6 +4,7 @@ metadata:
   name: ok-server
 spec:
   type: LoadBalancer
+  externalTrafficPolicy: Local
   selector:
     app: ok-server
   ports:

k3s/traefik-config.yaml

@@ -0,0 +1,10 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    service:
+      spec:
+        externalTrafficPolicy: Local