Prefer local ingress endpoints behind k3s ServiceLB

k8s-ng/core/traefik-config/helmchartconfig.yaml

@@ -16,6 +16,10 @@ spec:
     service:
       spec:
         externalTrafficPolicy: Local
+        # ServiceLB masquerades clients as pod traffic before the NodePort hop,
+        # which bypasses externalTrafficPolicy. Prefer the ingress on this node
+        # for that cluster-policy path as well.
+        trafficDistribution: PreferSameNode
     tolerations:
       - key: workload
         operator: Equal