openclaw: service.externalTrafficPolicy option

openclaw/Chart.yaml

@@ -7,7 +7,7 @@ description: >-
   is tracked directly off openclaw/openclaw releases via the annotation below
   and scripts/update-charts.sh.
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "2026.9.6"
 annotations:
   version-source: github-release:openclaw/openclaw

openclaw/templates/service.yaml

@@ -7,6 +7,9 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 spec:
   type: {{ .Values.service.type }}
+  {{- with .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ . }}
+  {{- end }}
   selector:
     app: {{ .Release.Name }}
   ports:

openclaw/values.yaml

@@ -15,6 +15,10 @@ httpPort: 18789
 service:
   type: ClusterIP
   port: 18789
+  # For LoadBalancer/NodePort: "Local" keeps the real client IP. Required when
+  # gateway.trustedProxies covers the pod CIDR, otherwise SNATed direct
+  # connections look like a proxy without forwarded headers and get rejected.
+  externalTrafficPolicy: ""
 
 # Secret with Gateway/provider credentials, loaded whole via envFrom. Keys
 # become env vars, e.g. OPENCLAW_GATEWAY_TOKEN (required: non-loopback binds