解决 docker swarm 节点容器无法获取客户端真实IP

下载工具

https://github.com/sangbobo/docker-ingress-routing-daemon

下载代码
将docker-ingress-routing-daemon放到/usr/bin下

mv docker-ingress-routing-daemon
chmod +x docker-ingress-routing-daemon

设置开启自启

vi /etc/systemd/system/dird.service

填入内容

[Unit]
Description=Docker Ingress Routing Daemon
After=sysinit.target dockerd.service
StartLimitIntervalSec=0

[Service]
ExecStart=/usr/bin/docker-ingress-routing-daemon --install --preexisting --ingress-gateway-ips "10.0.0.2 10.0.0.3 10.0.0.4 10.0.0.5 10.0.0.6 10.0.0.7 10.0.0.8 10.0.0.9"
Restart=always

[Install]
WantedBy=multi-user.target

开机自启

systemctl enable dird

启动

systemctl start dird

其他

1、正常在swarm有主节点和多个子节点，需要在每个主节点和子节点上都运行以上操作

2、–ingress-gateway-ips 后面的ip列表需要涵盖所有主节点和子节点的ip
可以直接运行

docker-ingress-routing-daemon

命令查看当前节点的IP，在主机上运行以上命令得到

Docker Ingress Routing Daemon v4.2.0

Usage: /usr/bin/docker-ingress-routing-daemon [--install [OPTIONS] | --uninstall | --help]

         --services <services>   - service names to whitelist (i.e. disable masquerading for)
           --tcp-ports <ports>   - TCP ports to whitelist (i.e. disable masquerading for)
           --udp-ports <ports>   - UDP ports to whitelist (i.e. disable masquerading for)
   --ingress-gateway-ips <ips>   - specify load-balancer ingress IPs
                 --preexisting   - optionally install rules where needed
                                   on preexisting containers (recommended)

               --iptables-wait   - pass '--wait' option to iptables
   --iptables-wait-seconds <n>   - pass '--wait <n>' option to iptables

              --no-performance   - disable performance optimisations
                 --indexed-ids   - use sequential ids for load balancers
                                   (forced where ingress subnet larger than /24)

Notes:
- <services>, <ports> and <ips> may be comma-separated, space-separated,
  or the relevant option specified multiple times;
- an IP of 'null' will be skipped, allowing old IPs to be retired without
  changing the indexes of serving IPs.

Detected ingress subnet and node IP:
- Ingress subnet: 10.0.0.0/24
- This node's ingress network IP: 10.0.0.2

This node’s ingress network IP: 10.0.0.2
这里的内容就是当前节点的ip，收集所有ip后，填入到–ingress-gateway-ips后的ip集合中

参考

https://github.com/newsnowlabs/docker-ingress-routing-daemon
https://github.com/moby/moby/issues/25526
https://eyehere.net/2019/%E5%9C%A8docker-swarm-mode%E4%B8%AD%E8%8E%B7%E5%BE%97%E7%9C%9F%E5%AE%9E%E7%9A%84%E5%AE%A2%E6%88%B7ip/