解决 docker swarm 节点容器无法获取客户端真实IP

下载工具

https://github.com/sangbobo/docker-ingress-routing-daemon

下载代码

将docker-ingress-routing-daemon放到/usr/bin下

bash 复制代码

mv docker-ingress-routing-daemon
chmod +x docker-ingress-routing-daemon

设置开启自启

bash 复制代码

vi /etc/systemd/system/dird.service

填入内容

bash 复制代码

[Unit]
Description=Docker Ingress Routing Daemon
After=sysinit.target dockerd.service
StartLimitIntervalSec=0

[Service]
ExecStart=/usr/bin/docker-ingress-routing-daemon --install --preexisting --ingress-gateway-ips "10.0.0.2 10.0.0.3 10.0.0.4 10.0.0.5 10.0.0.6 10.0.0.7 10.0.0.8 10.0.0.9"
Restart=always

[Install]
WantedBy=multi-user.target

开机自启

bash 复制代码

systemctl enable dird

启动

bash 复制代码

systemctl start dird

其他

1、正常在swarm有主节点和多个子节点，需要在每个主节点和子节点上都运行以上操作

2、--ingress-gateway-ips 后面的ip列表需要涵盖所有主节点和子节点的ip

可以直接运行

bash 复制代码

docker-ingress-routing-daemon

命令查看当前节点的IP，在主机上运行以上命令得到

bash 复制代码

Docker Ingress Routing Daemon v4.2.0

Usage: /usr/bin/docker-ingress-routing-daemon [--install [OPTIONS] | --uninstall | --help]

         --services <services>   - service names to whitelist (i.e. disable masquerading for)
           --tcp-ports <ports>   - TCP ports to whitelist (i.e. disable masquerading for)
           --udp-ports <ports>   - UDP ports to whitelist (i.e. disable masquerading for)
   --ingress-gateway-ips <ips>   - specify load-balancer ingress IPs
                 --preexisting   - optionally install rules where needed
                                   on preexisting containers (recommended)

               --iptables-wait   - pass '--wait' option to iptables
   --iptables-wait-seconds <n>   - pass '--wait <n>' option to iptables

              --no-performance   - disable performance optimisations
                 --indexed-ids   - use sequential ids for load balancers
                                   (forced where ingress subnet larger than /24)

Notes:
- <services>, <ports> and <ips> may be comma-separated, space-separated,
  or the relevant option specified multiple times;
- an IP of 'null' will be skipped, allowing old IPs to be retired without
  changing the indexes of serving IPs.

Detected ingress subnet and node IP:
- Ingress subnet: 10.0.0.0/24
- This node's ingress network IP: 10.0.0.2

This node's ingress network IP: 10.0.0.2

这里的内容就是当前节点的ip，收集所有ip后，填入到--ingress-gateway-ips后的ip集合中

参考

https://github.com/newsnowlabs/docker-ingress-routing-daemon

https://github.com/moby/moby/issues/25526

https://eyehere.net/2019/在docker-swarm-mode中获得真实的客户ip/