A company is hosting an internet-facing app on Amazon EKS using the Amazon VPC CNI plugin for pod networking. They need to expose the app via a Network Load Balancer (NLB) and ensure pods see the original source IP from packets the NLB receives. How should the NLB and EKS service be configured to satisfy this?

To preserve the client's source IP address when using an NLB with EKS, two key configurations are required. First, the NLB must use ip as its target type. This allows the NLB to directly route traffic to the pod IPs, which are managed by the VPC CNI plugin. If instance target type were used, traffic would first go to the EC2 instance and then to the pod, losing the original source IP. Second, the Kubernetes service must have externalTrafficPolicy: Local set. This ensures that traffic is only routed to pods running on the same node where the NLB target group health check passed. If externalTrafficPolicy: Cluster were used, traffic could be routed to any pod in the cluster, potentially losing the source IP due to an additional NAT hop.