From 2b9dc795c13b6f308cc9f7fbf0d18510fb91c0c1 Mon Sep 17 00:00:00 2001
From: sHa <sha@shadoll.dev>
Date: Sun, 27 Sep 2026 16:32:23 +0300
Subject: [PATCH] openclaw: service.externalTrafficPolicy option

---
 openclaw/Chart.yaml             | 2 +-
 openclaw/templates/service.yaml | 3 +++
 openclaw/values.yaml            | 4 ++++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/openclaw/Chart.yaml b/openclaw/Chart.yaml
index 26a36f4..95e1dc6 100644
--- a/openclaw/Chart.yaml
+++ b/openclaw/Chart.yaml
@@ -7,7 +7,7 @@ description: >-
   is tracked directly off openclaw/openclaw releases via the annotation below
   and scripts/update-charts.sh.
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "2026.9.6"
 annotations:
   version-source: github-release:openclaw/openclaw
diff --git a/openclaw/templates/service.yaml b/openclaw/templates/service.yaml
index ef6cea2..e08e016 100644
--- a/openclaw/templates/service.yaml
+++ b/openclaw/templates/service.yaml
@@ -7,6 +7,9 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
   type: {{ .Values.service.type }}
+  {{- with .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ . }}
+  {{- end }}
   selector:
     app: {{ .Release.Name }}
   ports:
diff --git a/openclaw/values.yaml b/openclaw/values.yaml
index eb13c99..1d56237 100644
--- a/openclaw/values.yaml
+++ b/openclaw/values.yaml
@@ -15,6 +15,10 @@ httpPort: 18789
 service:
   type: ClusterIP
   port: 18789
+  # For LoadBalancer/NodePort: "Local" keeps the real client IP. Required when
+  # gateway.trustedProxies covers the pod CIDR, otherwise SNATed direct
+  # connections look like a proxy without forwarded headers and get rejected.
+  externalTrafficPolicy: ""
 
 # Secret with Gateway/provider credentials, loaded whole via envFrom. Keys
 # become env vars, e.g. OPENCLAW_GATEWAY_TOKEN (required: non-loopback binds