SNAT ate my source IP

A LoadBalancer service with the default traffic policy rewrites every incoming packet's source to the node's own address — so by the time a network policy sees it, the real client is gone. You cannot allowlist a sender the network has already erased.

• security
• networking
• cilium
• kubernetes
• load-balancing