Traefik proxy protocol in k3s: are your trusted IPs safe?

TL;DR: Proxy protocol support in Traefik for k3s preserves the originating client IP across load balancers, but Codenotary shows that trusting the wrong source IP can let an attacker forge identity-bearing headers and skew allow or block decisions. The control boundary is not the header itself but the tightly constrained set of IPs allowed to assert it.

Editorial analysis by NHI Mgmt Group, based on content published by Codenotary: “Traefik, k3s and the proxy protocol”.

Key questions

Q: How should teams prevent forged client IPs in proxy protocol setups?

A: Treat the proxy path as a trust boundary and allow only known upstream addresses to assert source IP metadata.

Q: Why do source IP controls fail when traffic passes through ingress proxies?

A: They fail when the system trusts asserted origin metadata without validating who was allowed to assert it.

Q: What signs show that ingress provenance handling is misconfigured?

A: Look for inconsistent client IPs in logs, allow or block decisions that change after topology changes, and proxies that accept forwarded origin data from more than the expected load balancer range.

Practitioner guidance

• Lock proxy protocol to trusted upstream addresses Configure Traefik so only the known load balancer IPs can assert proxy protocol metadata, and remove any broad or temporary ranges once the deployment stabilises.
• Preserve source IP across ingress routing Set externalTrafficPolicy to Local where the originating client IP is required for security decisions, then verify that requests still reach the correct pods without losing provenance.
• Audit all IP-based access controls Find allow lists, deny lists, rate limits, and alerting rules that depend on client IP and confirm they use trusted ingress metadata rather than directly trusted request headers.

Bottom line: Proxy protocol can preserve client provenance through ingress layers, but only if the receiver trusts a tightly bounded set of upstream sources.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →