From 47589988bf9c1125f2ffb886c83118d37cfaeff6 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Thu, 15 Oct 2026 00:37:02 +0100
Subject: [PATCH] Prefer local ingress endpoints behind k3s ServiceLB

---
 k8s-ng/core/traefik-config/helmchartconfig.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/k8s-ng/core/traefik-config/helmchartconfig.yaml b/k8s-ng/core/traefik-config/helmchartconfig.yaml
index 3d01157..99cf248 100644
--- a/k8s-ng/core/traefik-config/helmchartconfig.yaml
+++ b/k8s-ng/core/traefik-config/helmchartconfig.yaml
@@ -16,6 +16,10 @@ spec:
     service:
       spec:
         externalTrafficPolicy: Local
+        # ServiceLB masquerades clients as pod traffic before the NodePort hop,
+        # which bypasses externalTrafficPolicy. Prefer the ingress on this node
+        # for that cluster-policy path as well.
+        trafficDistribution: PreferSameNode
     tolerations:
       - key: workload
         operator: Equal