Uploaded image for project: 'OpenShift Top Level Product Strategy'
  1. OpenShift Top Level Product Strategy
  2. OCPPLAN-7561

Not able to preserve client IP inside OCP 4.x cluster while accessing application from outside the cluster

XMLWordPrintable

    • Icon: Feature Feature
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • None
    • None
    • False
    • False
    • Not Set
    • No
    • Not Set
    • Not Set
    • Not Set
    • Undefined

      Issue: Cu wants to preserve the client ip in openshift. He is trying to access a service of type Loadbalancer (deployed with external IP and port)  from outside VM but in client IP, he is not getting the external VM IP as a client IP. 

      His application is not a web application and they are accessing the application using WinSCP/FileZila/SCP client (installed on external VM) from outside the cluster.

       

      Environment: VMware On premise 

      OCP Cluster version:  4.6, 4.5,4.4

      Action summary so far: 

      1. Asked customer to check for  setting "externalTrafficPolicy: Local" to preserve the client IP when service type is "LoadBalancer". But after making those changes still same issue.
      2. Asked to check the same with service of type node port. It worked as expected with nodeport but cu insist to go with external IP approach.
      3. Also with node port we do not have high availability in case if pod moves to a another worker machine hence cu wanted to go with service of type LB in their production environment.
      4. According to them it is working in Kubernetes but failing with Openshift.
      5. I also suggested to use haproxy in front of node for HA and send the client information via headers. But their client like WinSCP/FileZila/SCP do not support proxy protocol.
      6. Cu do not want to go with router approach as well.

              Unassigned Unassigned
              rhn-support-magarg Manish Garg (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: